A WordPress role security checklist helps you audit, assign, and lock down user roles to prevent unauthorized access, privilege escalation, and site compromise.
WordPress user roles are the cheapest — and most overlooked — security upgrade your site will ever get. Yet most site owners assign roles once during setup and never review them again. That’s a critical mistake.
Every unnecessary Administrator account, every overprivileged Editor, and every stale user left behind by a former employee is a potential entry point for attackers. In fact, roughly half of hacked WordPress sites I’ve analyzed had one thing in common: far too many users with Administrator access.
This 2026 WordPress role security checklist gives you a complete, step-by-step framework to:
-
Understand what each default role can (and can’t) do
-
Apply the principle of least privilege across your team
-
Audit existing users and remove dangerous accounts
-
Create custom roles that match real workflows
-
Lock down high-risk capabilities like file editing and user creation
-
Set up ongoing monitoring and quarterly audits
Whether you run a solo blog, a content team, or a WooCommerce store, this checklist ensures every account has exactly the access it needs — and nothing more.
Last updated: September 2026 | Tested on WordPress 7.0+
Why User Roles Are Your First Line of Defense
WordPress roles control who can do what on your site. A misconfigured role — or worse, an unnecessary Administrator account — is one of the fastest ways to get hacked.
Think about what a compromised account is worth:
-
A stolen Subscriber login gets an attacker a profile page.
-
A stolen Author login lets them publish spam posts — visible, embarrassing, fixable.
-
A stolen Administrator login gives them everything: plugin installation (arbitrary PHP), theme file editing, user creation (persistence), database exports, and the ability to delete evidence.
The gap between “embarrassing afternoon” and “site rebuilt from backups, blacklisted by Google” is very often just the role attached to the phished account.
Roles fix this for free. They’re built into WordPress core, need no maintenance, and directly shrink the two numbers attackers care about:
-
How many accounts are worth attacking
-
How much damage a stolen account can do.
The 6 Default WordPress Roles (And Their Security Risks)
WordPress ships with six default roles. Each has a specific capability set that determines what a user can see, create, edit, publish, and delete. trustiwp
Understanding what each role can actually do is the first step toward proper access control.
1. Administrator: The Most Dangerous Role
Capabilities: Everything — install/delete plugins, edit themes, create/delete users, modify files, change site settings, manage all content, export the entire database via plugins.
Security risk: If an attacker compromises an Administrator account, the site is theirs. They can install backdoor plugins, delete your content, steal your database, or redirect traffic to malicious sites.
Best practice:
-
Limit Administrator accounts to 2–3 people maximum (site owner + lead developer).
-
Never share an Administrator account.
-
Enforce strong passwords + two-factor authentication (2FA) on all Administrator accounts.
-
Rename obvious usernames like
adminto reduce brute-force targeting.
Attack scenario: An attacker obtains admin credentials through phishing. Within 60 seconds, they install a plugin that creates a hidden admin account, exfiltrates the user database, and injects malicious JavaScript into the footer. You may not notice for days or weeks.
2. Editor: Full Content Control Without System Access
Capabilities: Publish, edit, and delete any post or page (including others’), manage categories/tags/comments, moderate all comments, upload files.
Cannot do: Install plugins/themes, change site settings, manage users, access site health tools.
Security risk: Editors are prime targets for privilege escalation attacks. If compromised, they can publish malicious content, inject harmful shortcodes, modify existing posts to include malware, or delete critical pages (homepage, legal pages, landing pages).
Best practice:
-
Assign Editor only to senior content managers who supervise messaging.
-
Enforce 2FA on Editor accounts (they can publish raw HTML, including
<script>tags). -
Review Editor activity logs regularly.
Attack scenario: An attacker gains Editor access via a reused password. They edit a high-ranking blog post, adding hidden spam links or iframes. The compromised post continues to rank, distributing malware to visitors for weeks.
3. Author: Publishing Power with File Upload Risks
Capabilities: Write, edit, publish, and delete their own posts; upload files (images, documents, media) to the Media Library.
Cannot do: Edit others’ content, create pages, manage comments beyond their own posts, install plugins/themes.
Security risk: Authors can upload files to wp-content/uploads. If the upload handler has a vulnerability — or if PHP execution is not blocked in the uploads directory — an attacker can upload a PHP shell disguised as a JPEG and gain remote code execution.
Best practice:
-
Block PHP execution in
wp-content/uploadsvia.htaccessor server config. -
Use Author role only for trusted, regular writers.
-
Monitor uploaded files for suspicious extensions.
Attack scenario: An attacker registers as an Author (if registration is enabled) and uploads a PHP file disguised as a JPEG. The server doesn’t block PHP execution in uploads. The attacker accesses the file directly and gains remote code execution, then installs a cryptominer or exfiltrates the database.
4. Contributor: Write Access Without Publishing
Capabilities: Write and edit their own drafts; submit posts for review.
Cannot do: Publish anything, upload files, access the Media Library.
Security risk: Contributors are relatively low risk for direct damage, but they can still submit posts containing malicious shortcodes, harmful HTML, or content that exploits other vulnerabilities. They can also use the REST API for user enumeration to gather usernames for brute-force attacks.
Best practice:
-
Use Contributor for guest authors or first-time writers.
-
Always review and publish Contributor submissions before they go live.
-
Disable user registration unless you genuinely need it.
Attack scenario: An attacker registers as a Contributor and uses the WordPress REST API to enumerate all users on the site, building a list of usernames for a brute-force attack against Administrator accounts.
5. Subscriber: The Most Limited Role
Capabilities: Manage their own profile (change password, update email), view their own comments.
Cannot do: Write posts, upload files, access any admin features beyond their profile.
Security risk: While Subscribers have very limited capabilities, they still represent an attack surface. A compromised Subscriber account can be used for user enumeration via the REST API, brute-force probing, and social engineering. If your site allows registration, attackers can create Subscriber accounts at scale to probe for vulnerabilities.
Best practice:
-
Set “New User Default Role” to Subscriber (Settings → General).
-
Disable open registration unless you need it (e.g., for comments or memberships).
-
Monitor for mass Subscriber account creation (sign of automated probing).
Attack scenario: An automated script registers hundreds of Subscriber accounts. These accounts probe the REST API for user data, test common vulnerability patterns in plugins, and report back to a command server. Because Subscriber accounts look legitimate, they may not trigger security alerts.
6. Super Admin (Multisite Only)
Capabilities: Manage every site in a WordPress Multisite network, install/activate plugins network-wide, manage themes, create/delete subsites.
Security risk: Compromising a Super Admin account means complete control over every site in the network. On a network with 100 client sites, one breach = 100 sites compromised at once.
Best practice:
-
Limit Super Admin accounts to absolute minimum (1–2 people).
-
Require strong 2FA on all Super Admin accounts.
-
Monitor Super Admin activity continuously.
WordPress Role Security Checklist: 25 Steps to Lock Down Access
Use this checklist to audit, assign, and secure user roles across your WordPress site.
Phase 1: Audit Existing Users
1. List All Users Sorted by Role
-
Go to Users → All Users in your dashboard.
-
Filter by role (Administrators first).
-
Export the list if possible (some plugins allow CSV export).
2. Question Every Administrator by Name
For each Administrator, ask:
-
Which human is this?
-
Do they still work here (or with this site)?
-
Have they used admin powers in the last quarter?
Anything without three good answers gets demoted or deleted today.
3. Match Every Account to a Real, Current Person
Remove or downgrade accounts belonging to:
-
Former employees
-
Finished freelancers or contractors
-
Old agencies from past contracts
-
Test accounts (e.g.,
test,test2,demo)
4. Check Last Login Dates
-
Use an activity log plugin (e.g., WP Activity Log, Simple History) to see last login.
-
An account that hasn’t logged in for 6–12 months is either abandoned (delete it) or a service account (document it).
5. Identify Suspicious or Unknown Accounts
Look for:
-
Usernames you don’t recognize
-
Suspicious email addresses (especially free domains like
@gmail.comon business sites) -
Multiple accounts with similar usernames
-
Accounts created around the same time as suspicious activity.
Phase 2: Apply Least Privilege
6. Limit Administrator Access to 2–3 People Maximum
-
Reserve Administrator for site owners and lead developers only.
-
Everyone else should use Editor, Author, or a custom role.
7. Assign the Minimum Necessary Role
Always start with the lowest permission level needed for the user’s job function. You can always upgrade their role later if needed.
Quick reference:
-
Solo site owner: Administrator (only for you)
-
Blog writer who publishes their own posts: Author
-
Writer who submits drafts for review: Contributor
-
Editor who manages all content + comments: Editor
-
Client who owns the site: Administrator (for rare admin tasks) + Editor (for daily work)
8. Create Separate Editor/Author Accounts for Daily Work
Even if you’re an Administrator, use an Editor or Author account for daily content work. Keep the Administrator login for actual administration (plugins, users, settings).vishal-bhisara+1
9. Demote Overprivileged Users
If someone has Administrator access but only edits content:
-
Change their role to Editor or Author.
-
Test that they can still do their job.
-
Communicate the change as a security best practice, not a lack of trust.
10. Remove Inactive Users Immediately
Set a recurring calendar reminder (quarterly is a good start) to review your user list and remove accounts that haven’t logged in for 6+ months.
Phase 3: Harden High-Risk Capabilities
11. Disable File Editing in wp-config.php
Add this line to wp-config.php to prevent anyone (including Administrators) from editing theme/plugin PHP files from the dashboard:
define( 'DISALLOW_FILE_EDIT', true );This blocks a common post-compromise tactic where attackers use the file editor to plant backdoors.
12. Block PHP Execution in wp-content/uploads
Prevent uploaded PHP shells from executing by adding this to your .htaccess (Apache) or server config:
<FilesMatch "\.php$">
Order Deny,Allow
Deny from all
</FilesMatch>Place this in wp-content/uploads/.htaccess.trustiwp+1
13. Disable User Registration (Unless You Need It)
Go to Settings → General and uncheck “Anyone can register” unless you genuinely need public signups (e.g., for comments or memberships).
14. Set Default Role to Subscriber
In the same settings page, ensure “New User Default Role” is set to Subscriber — never Author, Editor, or Administrator.
15. Enforce Two-Factor Authentication (2FA) on Privileged Accounts
Use a plugin like Wordfence, WP 2FA, or built-in host tools to require 2FA for:
-
All Administrators
-
All Editors (optional but recommended)
-
Shop Managers (on WooCommerce sites)
Phase 4: Monitor and Maintain
16. Install an Activity Log Plugin
Track who logged in, when, and what actions they took. Recommended plugins:
-
WP Activity Log
-
Simple History
-
Trusti Security (includes admin activity logging).
17. Review Activity Logs Monthly
Look for:
-
New user creations
-
Role changes
-
Plugin/theme installations
-
Password resets
-
Failed login attempts
18. Set Up Alerts for New Administrator Accounts
Configure your activity log plugin to email you immediately when a new Administrator is created. This catches hidden backdoor accounts early.
19. Schedule Quarterly User Audits
Add a recurring calendar reminder every 3 months to:
-
Review all users
-
Remove inactive accounts
-
Downgrade overprivileged users
-
Verify 2FA is enabled on privileged accounts.
20. Document Your Role Policy
Create a simple document that outlines:
-
Who has which role and why
-
How new roles are requested and approved
-
When access is revoked (e.g., when someone leaves the team)
-
Your 2FA requirements
Phase 5: Advanced Hardening (Optional but Recommended)
21. Block User Enumeration via .htaccess
Prevent attackers from discovering usernames via author archives:
# Block author enumeration
RewriteEngine On
RewriteBase /
RewriteCond %{QUERY_STRING} ^author=([0-9]*)
RewriteRule .* - [F,L]Add this to your root .htaccess file. trustiwp
22. Restrict REST API Users Endpoint
Add this to your theme’s functions.php or a custom plugin to block unauthorized access to /wp/v2/users:
function restrict_user_rest_api($response, $handler) {
if (!current_user_can('edit_users')) {
return new WP_Error(
'rest_user_cannot_view',
'You are not authorized to view users.',
array('status' => 401)
);
}
return $response;
}
add_filter('rest_pre_dispatch', 'restrict_user_rest_api', 10, 2);23. Use WP-CLI for Bulk User Management
If your host supports WP-CLI, use these commands for efficient audits:
# List all users with their roles
wp user list --fields=ID,user_login,display_name,roles,user_email
# List only administrators
wp user list –role=administrator –fields=ID,user_login,user_email
# Count users by role
wp user list –field=roles | sort | uniq -c | sort -rn
# Delete a user and reassign their posts
wp user delete <user_id> –reassign=<new_owner_id>
24. Create Custom Roles for Specific Workflows
If default roles don’t fit your team, create custom roles using a plugin like User Role Editor or Members, or via code:
// Add to functions.php or a custom plugin
function add_custom_roles() {
add_role(
'content_manager',
'Content Manager',
array(
'read' => true,
'edit_posts' => true,
'edit_others_posts' => true,
'publish_posts' => true,
'upload_files' => true,
'moderate_comments' => true,
'manage_categories' => true,
'edit_theme_options' => false,
'install_plugins' => false,
'edit_users' => false,
)
);
}
add_action('init', 'add_custom_roles');25. Test Roles in a Staging Environment
Before assigning new roles on your live site, test them in a staging environment to ensure users can do their jobs without excessive access.
WooCommerce Role Security Checklist
If you run a WooCommerce store, you have two additional roles to manage: Customer and Shop Manager.
Shop Manager: What They Can (and Can’t) Do
Capabilities: Manage orders, products, coupons, customers, and WooCommerce reports; edit content (Editor-level capabilities).
Cannot do: Install plugins/themes, change WooCommerce settings (payment gateways, tax rates, shipping zones), switch themes, or modify site-level settings.
Best practice:
-
Assign Shop Manager (not Administrator) to staff who handle daily orders, stock, or customer emails.
-
After installing a major WooCommerce extension, log in as a Shop Manager once to verify what new capabilities they may have gained.
Customer Role
-
Automatically assigned to anyone who creates an account during checkout.
-
Similar to Subscriber, but with access to order history and account details.
-
Never assign manually.
Common Mistakes to Avoid
-
Giving too many users Administrator access — Every additional admin multiplies your attack surface.
-
Never reviewing user roles after setup — Roles decay over time as people leave and projects end.Using shared “admin” accounts — No accountability, no offboarding, one leaked password compromises everything.
-
Forgetting to reassign content before deleting users — Always attribute posts/pages to another user before deletion.
-
Ignoring plugin-specific roles — Some plugins (e.g., membership, LMS, eCommerce) add their own roles and capabilities. Review them.
-
Allowing open registration with high default roles — Never set default role to anything above Subscriber.
WordPress Role Security Checklist (Downloadable PDF)
Want a printable version of this checklist? Here’s a condensed summary you can save or share with your team:
Quick Audit Checklist
-
List all users sorted by role (Administrators first)
-
Question every Administrator by name (3 good answers required)
-
Remove former employees, freelancers, agencies, test accounts
-
Check last login dates (delete accounts inactive for 6+ months)
-
Identify and investigate suspicious/unknown accounts
Least Privilege Checklist
-
Limit Administrators to 2–3 people maximum
-
Assign minimum necessary role for each user
-
Create separate Editor/Author accounts for daily work
-
Demote overprivileged users
-
Remove inactive users quarterly
Hardening Checklist
-
Disable file editing in
wp-config.php -
Block PHP execution in
wp-content/uploads -
Disable user registration (unless needed)
-
Set default role to Subscriber
-
Enforce 2FA on all privileged accounts
Monitoring Checklist
-
Install activity log plugin
-
Review logs monthly
-
Set up alerts for new Administrator accounts
-
Schedule quarterly user audits
-
Document your role policy
Frequently Asked Questions
What is the difference between a role and a capability in WordPress?
A role is a named bundle of permissions (e.g., “Editor”, “Author”). A capability is a single permission to perform a specific action (e.g., publish_posts, edit_users). WordPress groups capabilities together and assigns them to roles.
How many Administrators should a WordPress site have?
Two: the person responsible for the site (owner) and the developer or maintenance provider. One is fragile if locked out; three or more just multiplies phishing targets without adding recovery value.
What is the safest role to give a contractor?
Usually Contributor (drafts only) or Author (publish their own posts), depending on your editorial workflow. Avoid Administrator unless you fully trust them and have 2FA + audit logging enabled.
Should I disable the WordPress file editor?
Yes, on every site. Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php so nobody — including a stolen Administrator session — can edit theme or plugin PHP from the browser.
How often should I audit WordPress users?
Quarterly for most sites, and immediately whenever someone leaves the team. The audit takes about 15 minutes: verify every Administrator, remove stale and ex-staff accounts, check last logins, and confirm registration defaults to Subscriber.
Can a WooCommerce Shop Manager install plugins?
No. A Shop Manager can run orders, products, coupons, customers, and reports — but cannot install plugins, change WooCommerce settings, switch themes, or edit site settings. That’s exactly why staff should have Shop Manager instead of Administrator.
What role should I give my client or site owner?
An Administrator account for genuine admin moments (reviewing users, authorizing plugins), plus an Editor account for daily work (posts, pages, products, media). The client keeps full ownership; the account they use every day cannot break the site.
How do I create a custom user role without a plugin?
Add code to your theme’s functions.php file using the add_role() function. Define the new role and its capabilities. Always back up functions.php before making changes.
Why should I almost never grant manage_options or plugin install access?
Any account that can install plugins or change options can effectively take over the site (redirect traffic, inject code, create hidden admin users). Reserve these capabilities for site owners and lead developers only.
Final Thoughts: Roles Are Not Set-and-Forget
User roles are not a configuration you set once during launch and ignore forever. They’re a living, breathing part of your site’s security posture.
Every quarter, spend 15 minutes reviewing your user list. Ask:
-
Does this person still work here?
-
Do they still need this level of access?
-
Have they logged in recently?
-
Is their account protected with 2FA?
The answers will tell you whether your WordPress role security checklist is working — or whether you’ve quietly accumulated a list of time bombs waiting to explode.
Combine controlled role assignments with:
-
Regular audits
-
Strong authentication (passwords + 2FA)
-
Activity monitoring
-
Least-privilege permissions
-
Timely offboarding
That creates a much stronger foundation for protecting your WordPress site from unauthorized access, privilege escalation, and full-site compromise.
Discover more from WORDPRESS ROLE
Subscribe to get the latest posts sent to your email.