WordPress Capabilities List: All 50+ Capabilities Explained (2026)

WordPress capabilities list (also called “permissions”) are individual privileges that control what users can and cannot do on your website. From edit_posts to manage_options, each capability grants specific access to content, settings, plugins, and more.

Understanding WordPress capabilities is critical for:

• Security: Limiting capabilities prevents unauthorized access and reduces hack risk
• Customization: Create custom roles with exactly the permissions your users need
• Troubleshooting: Fix “permission denied” errors and capability issues
• Development: Build plugins and themes that respect WordPress permissions

This comprehensive guide covers all 50+ default WordPress capabilities, which roles have which capabilities, how to check and modify capabilities programmatically, plugin-added capabilities (like WooCommerce), and security best practices for managing permissions.

Quick Navigation:

• What Are WordPress Capabilities?
• All 50+ Capabilities List
• Capabilities by Role
• How to Check Capabilities
• How to Modify Capabilities
• WooCommerce Capabilities
• Security Best Practices
• FAQ
• Final Thoughts

What Are WordPress Capabilities?

A WordPress capability is an individual permission that grants a specific type of access. WordPress checks capabilities, not roles, when deciding if a user can perform an action.

Capabilities vs Roles: What’s the Difference?

Example: The “Editor” role includes capabilities like edit_posts, publish_posts, delete_posts, and manage_categories. When an Editor tries to publish a post, WordPress checks if they have the publish_posts capability—not whether they’re an “Editor.”

Learn more: WordPress Roles and Permissions: The Complete Guide

How WordPress Checks Capabilities

WordPress uses the current_user_can() function to check if the current user has a specific capability:

if ( current_user_can( 'edit_posts' ) ) {
    // User can edit posts
} else {
    // User cannot edit posts
}

This function returns true if the user has the capability, false otherwise.

All 50+ WordPress Capabilities (Complete List)

Here’s the complete list of all default WordPress capabilities, grouped by function:

Content Capabilities (Posts)

• edit_posts — Edit posts
• publish_posts — Publish posts
• delete_posts — Delete posts
• edit_published_posts — Edit already published posts
• delete_published_posts — Delete already published posts
• edit_others_posts — Edit posts created by other users
• delete_others_posts — Delete posts created by other users
• read — Read content (minimum capability for any dashboard access)
• read_private_posts — Read private posts
• edit_private_posts — Edit private posts
• delete_private_posts — Delete private posts
• unfiltered_html — Post unfiltered HTML (bypasses KSES filtering)

Pages Capabilities

• edit_pages — Edit pages
• publish_pages — Publish pages
• delete_pages — Delete pages
• edit_published_pages — Edit already published pages
• delete_published_pages — Delete already published pages
• edit_others_pages — Edit pages created by other users
• delete_others_pages — Delete pages created by other users
• read_private_pages — Read private pages
• edit_private_pages — Edit private pages
• delete_private_pages — Delete private pages

Media Capabilities

• upload_files — Upload media files (images, videos, documents)
• unfiltered_upload — Upload any file type (no MIME type restrictions)

Comments Capabilities

• moderate_comments — Approve, edit, spam, or delete comments
• edit_comment — Edit individual comments
• delete_comment — Delete individual comments
• edit_others_comments — Edit comments created by other users
• delete_others_comments — Delete comments created by other users

Plugins & Themes Capabilities

• activate_plugins — Activate and deactivate plugins
• edit_plugins — Edit plugin code (Plugin Editor)
• delete_plugins — Delete plugins
• install_plugins — Install new plugins
• update_plugins — Update plugins
• activate_themes — Activate themes
• edit_themes — Edit theme code (Theme Editor)
• delete_themes — Delete themes
• install_themes — Install new themes
• update_themes — Update themes
• switch_themes — Switch between installed themes

User Management Capabilities

• create_users — Create new users
• delete_users — Delete users
• edit_users — Edit user profiles
• list_users — View list of users
• promote_users — Change user roles
• remove_users — Remove users from the site

Site Settings Capabilities

• manage_options — Access all site settings (most powerful capability)
• manage_categories — Manage categories and tags
• manage_links — Manage blogroll links (legacy feature)
• import — Use the Import tool
• export — Use the Export tool

Design & Customization Capabilities

• edit_theme_options — Use the Customizer
• customize — Access the Customizer (alias for edit_theme_options)

Level Capabilities (Legacy)

• level_0 to level_10 — Legacy user levels (deprecated, but still used by some plugins)

Complete guide: WordPress Roles and Permissions: The Complete Guide

WordPress Capabilities by Role (Complete Table)

Here’s which capabilities each default WordPress role has:

Key: ✅ = Has capability, ❌ = Does not have capability

Complete guide: WordPress Roles and Permissions: The Complete Guide

How to Check WordPress Capabilities

There are several ways to check if a user has a specific capability:

Method 1: current_user_can() Function

The most common way to check capabilities in WordPress:

if ( current_user_can( 'edit_posts' ) ) {
    // User can edit posts
    echo 'You can edit posts!';
} else {
    // User cannot edit posts
    echo 'You cannot edit posts.';
}

Method 2: Check Specific User’s Capabilities

Check capabilities for a specific user (not just the current user):

$user = wp_get_current_user();

if ( in_array( 'edit_posts', $user->caps ) ) {
    // User has edit_posts capability
}

Method 3: Check User’s Role Capabilities

Get all capabilities for a specific role:

$role = get_role( 'editor' );
$capabilities = $role->capabilities;

foreach ( $capabilities as $capability => $value ) {
    echo $capability . '
';
}

Method 4: Check if User Has Specific Role

Sometimes you want to check the role, not individual capabilities:

$user = wp_get_current_user();

if ( in_array( 'editor', $user->roles ) ) {
    // User is an Editor
}

Complete tutorial: current_user_can Function: Complete Guide

How to Modify WordPress Capabilities

You can add, remove, or modify capabilities using code or plugins:

Method 1: Add Capability to Role (Code)

function add_capability_to_role() {
    $role = get_role( 'editor' );
    $role->add_cap( 'manage_options' );
}
add_action( 'init', 'add_capability_to_role' );

This adds the manage_options capability to the Editor role (not recommended for security!).

Method 2: Remove Capability from Role (Code)

function remove_capability_from_role() {
    $role = get_role( 'editor' );
    $role->remove_cap( 'edit_pages' );
}
add_action( 'init', 'remove_capability_from_role' );

This removes the edit_pages capability from the Editor role.

Method 3: Create Custom Role with Specific Capabilities (Code)

function create_custom_role() {
    add_role(
        'content_manager',
        'Content Manager',
        array(
            'read' => true,
            'edit_posts' => true,
            'edit_pages' => true,
            'publish_posts' => true,
            'publish_pages' => true,
            'upload_files' => true,
            'manage_categories' => true,
        )
    );
}
add_action( 'init', 'create_custom_role' );

This creates a custom “Content Manager” role with specific capabilities.

Method 4: Using Plugins

Popular role management plugins:

• User Role Editor — Most popular, free, easy to use
• Members — Clean interface, good for beginners
• PublishPress Capabilities — Advanced features for developers

Complete tutorial: WordPress Role Management Plugins

WooCommerce Capabilities (Shop Manager and Customer)

If you run an online store with WooCommerce, additional capabilities are automatically added:

Shop Manager Capabilities

Shop Managers have all Editor capabilities plus:

• manage_woocommerce — Access WooCommerce settings
• view_woocommerce_reports — View sales and analytics reports
• manage_product_terms — Manage product categories and tags
• edit_products — Edit products
• delete_products — Delete products
• edit_orders — Edit orders
• delete_orders — Delete orders
• edit_coupons — Edit coupons
• delete_coupons — Delete coupons

Customer Capabilities

Customers have Subscriber capabilities plus:

• pay — Pay for orders
• view_order_history — View order history
• edit_address — Edit billing/shipping addresses
• download_products — Download purchased digital products

Complete guide: WooCommerce Roles: Shop Manager & Customer

WordPress Capabilities Security Best Practices

Proper capability management is critical for WordPress security:

1. Follow the Principle of Least Privilege

Give users only the capabilities they need, nothing more. Never give manage_options unless absolutely necessary.

2. Audit Capabilities Regularly

Review user capabilities every 3-6 months. Remove unnecessary capabilities from custom roles.

3. Be Careful with Custom Capabilities

When adding custom capabilities, use unique names to avoid conflicts with plugins:

// Good: Unique, prefixed capability name
$role->add_cap( 'myplugin_manage_settings' );

// Bad: Generic name that might conflict
$role->add_cap( 'manage_settings' );

4. Don’t Give manage_options Lightly

The manage_options capability grants access to all site settings. Only Administrators should have this by default.

5. Use Capabilities in Your Plugins/Themes

Always check capabilities before allowing actions:

if ( current_user_can( 'edit_posts' ) ) {
    // Show edit button
}

Complete guide: WordPress Security Best Practices

Frequently Asked Questions

What are WordPress capabilities?

WordPress capabilities are individual permissions that control what users can and cannot do on your website. Examples include edit_posts, manage_options, and upload_files.

What is the difference between roles and capabilities?

A role is a named collection of capabilities (like “Editor” or “Author”). A capability is an individual permission (like edit_posts or manage_options). WordPress checks capabilities, not roles, when deciding if a user can do something.

How many capabilities does WordPress have?

WordPress has 50+ default capabilities, plus additional capabilities added by plugins like WooCommerce, membership plugins, and custom plugins.

What is the most powerful WordPress capability?

The manage_options capability is the most powerful. It grants access to all site settings and is only given to Administrators by default.

How do I check if a user has a capability?

Use the current_user_can() function: if ( current_user_can( 'edit_posts' ) ) { ... }

Can I create custom capabilities?

Yes, you can create custom capabilities by adding them to roles using $role->add_cap() or plugins like User Role Editor.

What capabilities does the Editor role have?

Editors have ~25 capabilities, including edit_posts, publish_posts, edit_pages, moderate_comments, and manage_categories.

What capabilities does the Administrator role have?

Administrators have all 50+ default capabilities, including manage_options, activate_plugins, edit_themes, and delete_users.

Final Thoughts: Master WordPress Capabilities

Understanding WordPress capabilities is essential for running a secure, well-organized website. Whether you’re managing user permissions, creating custom roles, or developing plugins, knowing how capabilities work gives you complete control over what users can and cannot do.

Key Takeaways:

• 50+ default capabilities: WordPress comes with over 50 built-in capabilities covering content, users, plugins, themes, and settings.
• Roles are collections of capabilities: Each role (Administrator, Editor, etc.) is just a named group of capabilities.
• WordPress checks capabilities, not roles: When deciding if a user can do something, WordPress checks their capabilities, not their role name.
• Use current_user_can() to check capabilities: This is the standard way to check if a user has permission to do something.
• Follow least privilege: Give users only the capabilities they need, nothing more. Never give manage_options unless absolutely necessary.
• WooCommerce adds capabilities: If you run a store, Shop Managers and Customers have additional WooCommerce-specific capabilities.
• Custom capabilities are powerful: You can create custom roles with exactly the capabilities you need using code or plugins.

Additional Resources:

For more authoritative information on WordPress capabilities, check out these official resources:

• WordPress.org: Roles and Capabilities Documentation — Official WordPress documentation
• WordPress Developer Handbook: Roles and Capabilities — Technical guide for developers
• WordPress Codex: Roles and Capabilities — Complete reference
• WPBeginner: WordPress User Roles and Permissions Explained — Beginner-friendly guide

What’s Next?

Now that you understand WordPress capabilities, take action:

1. Audit your current roles: Go to Users → All Users and review each account. Do they have the right capabilities?
2. Review custom roles: If you have custom roles, make sure they only have necessary capabilities.
3. Use capabilities in your code: Always check capabilities before allowing actions in your plugins/themes.
4. Bookmark this guide: Come back whenever you need to reference WordPress capabilities.
5. Learn about roles: Check out our Complete Guide to WordPress Roles to understand how capabilities are assigned to roles.

Ready to learn more? Check out our guides on WordPress Roles and Permissions, WordPress Security Best Practices, and WordPress Role Management Plugins.

Related Guides

• WordPress Roles and Permissions: The Complete Guide
• WordPress Permissions Category (All Guides)
• WordPress Administrator Role: Complete Breakdown
• WordPress Editor Role: Permissions and Capabilities
• WordPress Author Role Guide
• WordPress Contributor Role: Capabilities and Use Cases
• WordPress Subscriber Role Guide
• WordPress Super Admin Role Guide
• WooCommerce Roles: Shop Manager & Customer
• WordPress Security Best Practices
• WordPress Role Management Plugins
• WordPress User Management