Managing WordPress Users, Roles, and Permissions

Managing WordPress users, roles, and permissions comes down to one habit: give every person the smallest set of powers that still lets them do their job. WordPress ships with six built-in roles (Administrator, Editor, Author, Contributor, Subscriber, and Super Admin on multisite), and each one maps to a bundle of individual capabilities stored in your database. This guide covers the default roles, how to add and edit users, when to build custom roles, and the access audit most site owners skip until something breaks.

Roles vs. Capabilities: What WordPress Is Actually Checking

A capability is a single permission, like edit_posts, publish_pages, manage_options, or install_plugins. A role is just a named container holding a group of those capabilities, and WordPress core defines roughly 60 to 70 capabilities across posts, pages, media, themes, plugins, and settings.

Every time someone clicks a link in the dashboard, WordPress runs a check similar to current_user_can( 'edit_others_posts' ) and either loads the screen or throws a permission error. That distinction matters because you can change what a role can do without creating a new role, which is often the cleaner fix. The official WordPress roles and capabilities documentation lists every capability and which default role holds it.

The Six Default WordPress User Roles

The standard hierarchy runs Administrator, Editor, Author, Contributor, then Subscriber, with Super Admin sitting above everything on a multisite network. Here is what each one can and cannot touch on a single-site install:

• Administrator: total control. Installs and deletes plugins and themes, edits code, changes site settings and permalinks, creates and deletes users, and can remove other administrators. Keep this to one or two people.
• Editor: publishes, edits, and deletes any post or page, including content written by others. Moderates comments, manages categories and tags, uploads media. Cannot touch plugins, themes, settings, or users.
• Author: writes, publishes, edits, and deletes their own posts and uploads files. Cannot edit anyone else’s content or manage pages.
• Contributor: writes and edits their own drafts but cannot publish them and cannot upload images, which surprises most guest writers on day one.
• Subscriber: can read content and manage their own profile. That single read capability is the whole role, which makes it the right default for membership signups and comment accounts.
• Super Admin: multisite only. Manages every site on the network, plus network-wide plugins, themes, and user accounts.

If you are unsure, the safest picks are usually Contributor for freelance writers, Author for staff who publish their own work, Editor for a content manager or in-house marketer, and Administrator only for the person who owns the site and whoever maintains it. WooCommerce adds two more on top: Customer (essentially a Subscriber with order history) and Shop Manager, which can manage products, orders, coupons, and WooCommerce settings without gaining access to plugins or core settings.

How to Add, Edit, and Remove Users

Everything lives under Users in the left-hand dashboard menu, which is one of the screens covered in our beginner’s tour of the WordPress dashboard. The workflow takes under a minute per person once you know where to click.

1. Add a user: go to Users > Add New, enter a username and a real email address, pick the role from the dropdown, and check the box to email login details. Never share one admin login between multiple people.
2. Edit a user’s role: open Users > All Users, hover the name, click Edit, then change the Role dropdown near the top and save. Changes apply on their next page load.
3. Change roles in bulk: tick several checkboxes on the All Users screen, choose a role in the Change role to dropdown, and hit Change. Handy after a site launch when ten temporary admins need demoting.
4. Set the default role for new signups: Settings > General > New User Default Role. Leave it on Subscriber unless you have a specific reason not to.
5. Remove a user: hover the name and click Delete, then choose to attribute their existing posts to another user. Deleting without reassigning can orphan published content.

One habit worth adopting: change roles rather than deleting accounts when someone leaves temporarily. Dropping a former contractor to Subscriber preserves author archives and byline links while removing every write permission.

Custom User Roles and the Plugins Worth Using

The default roles fit a blog reasonably well and fit almost no business site perfectly. Common gaps include a bookkeeper who needs WooCommerce orders but nothing else, a designer who needs theme access but not user management, or an SEO consultant who needs to edit meta titles and redirects without full admin rights.

Three well-established options handle this without code:

For a closer look at this topic, see our guide: A Step-by-Step Guide to Migrating Your Website to WordPress.

For a closer look at this topic, see our guide: Managing 301 Redirects in WordPress Easily.

For a closer look at this topic, see our guide: Top 10 Fastest WordPress Themes in 2026.

• User Role Editor: the classic WordPress user role editor plugin. Tick and untick capabilities on existing roles, clone roles, and create new ones from a checklist.
• PublishPress Capabilities: strong for editorial teams, with per-role control over post types, taxonomies, and plugin-specific capabilities.
• Members: a roles and capabilities plugin that also handles content restriction, which makes it a decent single answer if you need both.

Prefer code? Register WordPress custom user roles programmatically with add_role(), for example add_role( 'seo_manager', 'SEO Manager', array( 'read' => true, 'edit_posts' => true, 'edit_others_posts' => true, 'edit_published_posts' => true ) );. Roles are written to the wp_user_roles option in the database, so the function only needs to run once, ideally on plugin activation, as explained in the WordPress developer handbook. Put custom role code in a small site-specific plugin, not in your theme’s functions.php, or a theme switch will take your roles with it.

Restricting Pages and Content by User Role

WordPress has no built-in setting for “only Editors can view this page,” so you have two routes. Plugins such as Members, PublishPress Permissions, Restrict Content, or MemberPress add a visibility box to each post and page where you tick the roles allowed to see it. For a one-off, a theme template wrapped in if ( current_user_can( 'edit_posts' ) ) does the job in three lines.

Two things people forget when they gate content. First, restricted pages should usually carry a noindex tag so Google is not crawling a login wall, and internal links to them should not sit in your main navigation. Second, redirecting logged-out visitors to a login screen can create soft 404 patterns, so handle it deliberately using the approach in our post on fixing 404 errors and setting up 301 redirects.

The Part Most Guides Skip: Permission Governance and SEO Risk

Almost every article on WordPress roles and permissions stops at the list. The expensive problems start later, when a site has eleven administrators, four of whom left the company. Verizon’s annual Data Breach Investigations Report has consistently found that the human element, including stolen credentials and misuse of legitimate access, factors into the large majority of breaches, and an unused admin account is exactly that kind of opening.

There is a search visibility angle too. An account with manage_options can toggle the search engine visibility checkbox, rewrite permalinks, edit robots directives, or change a plugin’s canonical settings, and none of it looks urgent until traffic drops two weeks later. If you have ever wondered why a site quietly deindexed itself, read our notes on robots.txt best practices and then check who holds admin.

A simple governance routine, run quarterly, prevents nearly all of it:

• Count your administrators. Most small business sites need two: the owner and the maintainer. Anything above four deserves a reason in writing.
• Match every account to a living person. Delete or demote anyone who has not logged in for 90 days, reassigning their content first.
• Kill shared logins. One account per human means audit logs and author attribution actually mean something.
• Use scoped access for tools. Application passwords and API-specific accounts beat handing an admin password to a third-party service.
• Require two-factor authentication on privileged roles and log role changes with an activity log plugin such as WP Activity Log or Simple History.
• Check plugin-level permissions. Yoast SEO, Rank Math, WooCommerce, and page builders each add their own capabilities that do not always follow the core hierarchy.

Where your site is hosted affects this too, since staging environments and per-user SFTP accounts are host features, not WordPress features. Our guide to choosing a WordPress hosting provider covers what to look for, and role assignment belongs on the pre-launch checklist alongside backups and analytics.

Troubleshooting Common Role Problems

Three issues account for most support tickets. A user reporting “Sorry, you are not allowed to access this page” is almost always missing one capability rather than the whole role, so compare their role against the capability list before promoting them. Missing dashboard menu items usually mean the same thing.

If custom roles vanish after deactivating a plugin, that is expected behavior when the plugin removed them on deactivation, and re-registering the role restores it. Locked out of your own admin account entirely? WP-CLI fixes it in one command (wp user set-role <user> administrator), or you can edit the wp_usermeta capabilities row through your host’s database tool.

Frequently Asked Questions

How do I manage users in WordPress?

Go to Users > All Users in the WordPress dashboard, where you can add, edit, delete, or bulk-reassign every account in under a minute. Adding a user takes a username, an email address, and a role selection; editing an existing person means opening their profile and changing the Role dropdown. Site owners should review this screen at least once a quarter.

What is the difference between roles and permissions?

A permission (WordPress calls it a capability) is one specific action such as publish_posts, while a role is a named group of 1 to 60-plus capabilities assigned to a person. WordPress checks capabilities, not role names, which is why editing a role’s capability list changes what every user in that role can do. Roles are the labels; capabilities are the actual rules.

How do I edit user roles in WordPress?

To change a person’s role, open Users > All Users, click Edit, and pick a new option from the Role dropdown, which takes about 15 seconds. To change what a role itself can do, or to create a new role, use a plugin like User Role Editor or PublishPress Capabilities, or register it in code with add_role() and add_cap().

How do I restrict WordPress pages by user role?

Core WordPress offers only password protection and private posts, so role-based restriction needs a plugin such as Members, PublishPress Permissions, or MemberPress, each of which adds a per-page role selector. Developers can wrap template output in current_user_can() instead. Add a noindex tag to gated pages so search engines are not crawling a login prompt.

Want a Second Set of Eyes on Your WordPress Setup?

Permission sprawl and SEO problems tend to travel together, and both are easier to fix before a traffic drop forces the issue. Get in touch with SEO Quirk for a review of your user access, site health, and search visibility, or read why working with a local agency tends to shorten that conversation.