WordPress Roles And Permissions Guide for Beginners

WordPress roles and permissions control what users can and cannot do on your website. From Administrator to Subscriber, each role comes with specific capabilities that determine access to content, settings, plugins, themes, and more.

WordPress Roles And Permissions Guide for Beginners
WordPress Roles And Permissions

Understanding WordPress roles is critical for:

  • Security: Limiting admin access prevents hacks and accidental damage
  • Workflow: Assigning the right role to each team member streamlines collaboration
  • Compliance: Proper role management helps meet GDPR, HIPAA, and other requirements

This comprehensive guide covers all 6 default WordPress roles (Administrator, Editor, Author, Contributor, Subscriber, and Super Admin), plus WooCommerce-specific roles like Shop Manager and Customer. You’ll also learn about 50+ capabilities, custom roles, security best practices, and how to assign the right permissions to every user on your site.

WordPress Roles And Permissions – Quick Navigation:

What Are WordPress Roles?

A WordPress role is a predefined collection of capabilities (permissions) assigned to users. WordPress checks capabilities, not roles, when deciding if a user can perform an action like publishing a post, installing a plugin, or changing site settings.

Roles vs Capabilities: What’s the Difference?

WordPress Roles WordPress Capabilities
Named groups of permissions (e.g., “Administrator”, “Editor”) Individual permissions (e.g., edit_posts, manage_options)
Assigned to users in the WordPress dashboard Checked by WordPress code to control access
6 default roles + custom roles 50+ default capabilities + plugin-added capabilities
Easy to understand and manage Technical, used by developers

Learn more: WordPress Permissions and Capabilities

6 Default WordPress Roles (Complete Breakdown)

WordPress comes with 6 pre-defined roles out of the box. Each role has a specific set of capabilities designed for different use cases.

1. Administrator

Capabilities: 50+ (full access)

Best For: Site owners, lead developers, trusted technical staff

The Administrator role has unrestricted access to all WordPress features, including:

  • Install, activate, and delete plugins
  • Install, activate, and delete themes
  • Create, edit, publish, and delete any content (posts, pages, media)
  • Manage all users (add, edit, delete, change roles)
  • Change all site settings (General, Reading, Discussion, Permalinks, etc.)
  • Access to all tools (Import, Export, Site Health, Debugging)

Security Warning: Never give Administrator access to freelancers, clients, or untrusted users. Limit admin accounts to 1-2 trusted people only.

Complete guide: WordPress Administrator Role

2. Editor

Capabilities: ~25

Best For: Content managers, senior writers, managing editors

Editors can manage all content on the site, including:

  • Create, edit, publish, and delete any posts or pages
  • Manage categories and tags
  • Moderate comments
  • Upload and manage media files
  • Edit content created by other users (Authors, Contributors)

What Editors CANNOT Do:

  • Install or activate plugins
  • Install or activate themes
  • Change site settings
  • Manage users (except their own profile)

Complete guide: WordPress Editor Role

3. Author

Capabilities: ~10

Best For: Staff writers, regular bloggers, content creators

Authors can create and manage their own content:

  • Create, edit, publish, and delete their own posts
  • Upload media files (images, videos, documents)
  • Edit their own profile

What Authors CANNOT Do:

  • Edit or delete other users’ content
  • Create or edit pages
  • Install plugins or themes
  • Change site settings
  • Moderate comments (except on their own posts)

Complete guide: WordPress Author Role

4. Contributor

Capabilities: 5

Best For: Guest writers, guest bloggers, freelance writers (under review)

Contributors can write and submit content for review:

  • Create and edit their own posts
  • Submit posts for editorial review
  • Delete their own posts (only if unpublished)

What Contributors CANNOT Do:

  • Publish posts (must be approved by Editor or Administrator)
  • Upload media files (must request admin to add images)
  • Edit published posts
  • Create pages

Complete guide: WordPress Contributor Role

5. Subscriber

Capabilities: 1 (read-only access)

Best For: Customers, newsletter subscribers, registered users

Subscribers have minimal access:

  • Read content on the site
  • Edit their own profile (change password, display name, etc.)
  • Post comments (if comments are enabled)

What Subscribers CANNOT Do:

  • Create or edit any content
  • Upload media files
  • Access the WordPress dashboard (except profile)

Complete guide: WordPress Subscriber Role

6. Super Admin (Multisite Only)

Capabilities: 50+ (network-wide access)

Best For: Multisite network owners, agency managing multiple sites

Super Admin exists only on WordPress Multisite networks. This role has:

  • All Administrator capabilities on every site in the network
  • Create and delete sites
  • Manage network-wide users
  • Install plugins and themes for the entire network
  • Change network settings

Important: Super Admin is NOT available on single-site WordPress installations.

Complete guide: WordPress Super Admin Role

WordPress Capabilities List (All 50+ Capabilities)

Capabilities are individual permissions that WordPress checks to control access. Here’s the complete list of all default WordPress capabilities:

Content Capabilities

  • edit_posts — Edit posts
  • publish_posts — Publish posts
  • delete_posts — Delete posts
  • edit_published_posts — Edit already published posts
  • delete_published_posts — Delete already published posts
  • edit_others_posts — Edit posts created by other users
  • delete_others_posts — Delete posts created by other users
  • read — Read content (minimum capability for any dashboard access)
  • read_private_posts — Read private posts
  • edit_private_posts — Edit private posts
  • delete_private_posts — Delete private posts

Pages Capabilities

  • edit_pages — Edit pages
  • publish_pages — Publish pages
  • delete_pages — Delete pages
  • edit_published_pages — Edit already published pages
  • delete_published_pages — Delete already published pages
  • edit_others_pages — Edit pages created by other users
  • delete_others_pages — Delete pages created by other users
  • read_private_pages — Read private pages
  • edit_private_pages — Edit private pages
  • delete_private_pages — Delete private pages

Media Capabilities

  • upload_files — Upload media files (images, videos, documents)
  • unfiltered_upload — Upload any file type (no MIME type restrictions)

Comments Capabilities

  • moderate_comments — Approve, edit, spam, or delete comments
  • edit_comment — Edit individual comments
  • delete_comment — Delete individual comments

Plugins and Themes Capabilities

  • activate_plugins — Activate and deactivate plugins
  • edit_plugins — Edit plugin code (Plugin Editor)
  • delete_plugins — Delete plugins
  • install_plugins — Install new plugins
  • update_plugins — Update plugins
  • activate_themes — Activate themes
  • edit_themes — Edit theme code (Theme Editor)
  • delete_themes — Delete themes
  • install_themes — Install new themes
  • update_themes — Update themes

User Management Capabilities

  • create_users — Create new users
  • delete_users — Delete users
  • edit_users — Edit user profiles
  • list_users — View list of users
  • promote_users — Change user roles
  • remove_users — Remove users from the site

Site Settings Capabilities

  • manage_options — Access all site settings (most powerful capability)
  • manage_categories — Manage categories and tags
  • manage_links — Manage blogroll links (legacy feature)
  • import — Use the Import tool
  • export — Use the Export tool

Design & Customization Capabilities

  • switch_themes — Switch between installed themes
  • edit_theme_options — Use the Customizer

Complete list: WordPress Permissions and Capabilities List

WooCommerce Roles (Shop Manager & Customer)

If you run an online store with WooCommerce, two additional roles are automatically added to your WordPress site:

Shop Manager

Capabilities: All Editor capabilities + WooCommerce-specific capabilities

Best For: Store managers, e-commerce staff, agency managing client stores

Shop Managers can:

  • Everything an Editor can do (manage all content)
  • Manage WooCommerce orders, products, coupons, and reports
  • Access WooCommerce settings (but NOT WordPress settings)
  • Manage product categories and tags
  • Process refunds and manage inventory

What Shop Managers CANNOT Do:

  • Install or activate plugins (including WooCommerce extensions)
  • Install or activate themes
  • Change WordPress site settings
  • Manage users (except their own profile)

Customer

Capabilities: Same as Subscriber + WooCommerce-specific capabilities

Best For: Online shoppers, registered customers

Customers can:

  • Everything a Subscriber can do (read content, edit profile)
  • Place orders and view order history
  • Manage billing and shipping addresses
  • Download purchased digital products
  • Leave product reviews

Complete guide: WooCommerce Roles: Shop Manager and Customer

How to Create Custom WordPress Roles

WordPress allows you to create custom roles with exactly the capabilities you need. This is useful when the default roles don’t fit your use case.

Method 1: Using Code (add_role Function)

Add this code to your theme’s functions.php file or a custom plugin:

function create_custom_role() {
    add_role(
        'custom_content_manager',
        'Content Manager',
        array(
            'read' => true,
            'edit_posts' => true,
            'edit_pages' => true,
            'publish_posts' => true,
            'publish_pages' => true,
            'upload_files' => true,
            'manage_categories' => true,
        )
    );
}
add_action('init', 'create_custom_role');

This creates a “Content Manager” role that can manage all content but cannot install plugins or change site settings.

Method 2: Using Plugins

Popular role management plugins:

  • User Role Editor — Most popular, free, easy to use
  • Members — Clean interface, good for beginners
  • PublishPress Capabilities — Advanced features for developers

Complete tutorial: WordPress Role Management Plugins

WordPress Roles Security Best Practices

Proper role management is one of the most important WordPress security measures. Follow these best practices:

1. Follow the Principle of Least Privilege

Give users the minimum permissions they need to do their job. Never give Administrator access unless absolutely necessary.

2. Audit User Roles Regularly

Review all user accounts every 3-6 months. Remove inactive users and downgrade users who no longer need elevated permissions.

3. Limit Administrator Accounts

Keep Administrator accounts to 1-2 trusted people only. Use a separate Administrator account for daily tasks (not your main account).

4. Use Two-Factor Authentication (2FA)

Require 2FA for all users with elevated permissions (Administrator, Editor, Shop Manager).

5. Remove Default “admin” Username

If you have a user named “admin”, create a new Administrator account, log in with it, and delete the old “admin” user.

6. Monitor User Activity

Use activity log plugins to track what users are doing on your site. This helps detect suspicious activity early.

Complete guide: WordPress Security Best Practices

Frequently Asked Questions

What are the 6 default WordPress roles?

The 6 default WordPress roles are: Administrator, Editor, Author, Contributor, Subscriber, and Super Admin (Multisite only).

What is the difference between WordPress roles and capabilities?

A role is a named collection of capabilities (like “Editor” or “Author”). A capability is an individual permission (like edit_posts or manage_options). WordPress checks capabilities, not roles, when deciding if a user can do something.

Which WordPress role should I give a freelance writer?

Use the Author role if they should publish independently, or Contributor if their work needs editorial review. Never give Administrator access to freelancers.

What role should I give my client?

For most clients, use the Editor role. They can manage all content (posts, pages, media) but cannot install plugins, change themes, or break the site.

How do I create a custom role in WordPress?

You can create custom roles using code (add_role() function) or plugins like User Role Editor or Members.

What is the most powerful WordPress capability?

The manage_options capability is the most powerful. It grants access to all site settings and is only given to Administrators by default.

Can I change a user’s role after creating their account?

Yes. Go to Users → All Users, click on the user, change their role dropdown, and click Update User.

What happens if I delete the only Administrator account?

You’ll be locked out of your site. Always keep at least one Administrator account. If you accidentally delete all admins, you’ll need to use phpMyAdmin or contact your hosting provider to restore access.

Final Thoughts: Master WordPress Roles and Permissions

Understanding WordPress roles and permissions is essential for running a secure, well-organized website. Whether you’re managing a multi-author blog, an online store, or a client site, assigning the right role to each user is one of the most important security measures you can take.

Key Takeaways:

  • Follow the principle of least privilege: Give users only the permissions they need, nothing more. Never hand out Administrator access unless absolutely necessary.
  • Know your 6 default WordPress roles: Administrator, Editor, Author, Contributor, Subscriber, and Super Admin each serve specific purposes. Choose the right role for each team member.
  • Understand capabilities: WordPress checks capabilities (like edit_posts or manage_options), not roles, when controlling access. Knowing this helps you troubleshoot permission issues.
  • Use WooCommerce roles wisely: If you run an online store, the Shop Manager role is powerful but safer than Administrator for e-commerce staff.
  • Create custom roles when needed: Don’t force users into default roles that don’t fit. Use plugins like User Role Editor or code to create custom roles with exactly the capabilities you need.
  • Audit regularly: Review user accounts every 3-6 months. Remove inactive users and downgrade users who no longer need elevated permissions.
  • Secure Administrator accounts: Use strong passwords, enable two-factor authentication (2FA), and never use “admin” as a username.

Additional Resources:

For more authoritative information on WordPress roles and permissions, check out these official resources:

What’s Next?

Now that you understand WordPress roles and permissions, take action:

  1. Audit your current users: Go to Users → All Users and review each account. Are they using the right role?
  2. Remove or downgrade unnecessary Administrators: If you have more than 2 Administrator accounts, consider downgrading some to Editor.
  3. Enable two-factor authentication: Use a plugin like Wordfence or Sucuri to require 2FA for all privileged users.
  4. Create a custom role if needed: If none of the default roles fit your use case, create a custom role with exactly the capabilities you need.
  5. Bookmark this guide: Come back whenever you need to reference WordPress roles, capabilities, or security best practices.

Ready to take your WordPress security to the next level? Check out our guides on WordPress Security Best Practices, WordPress Permissions and Capabilities List, and WordPress Role Management Plugins.

Related Guides

Discover more from WORDPRESS ROLES

Subscribe to get the latest posts sent to your email.

Related Posts

Discover more from WORDPRESS ROLES

Subscribe now to keep reading and get access to the full archive.

Continue reading