How to Manage WordPress User Roles and Permissions

Last updated: November 6, 2026 · By Ryan Walsh

User roles and permissions decide what each person can do on your WordPress site, from publishing posts to installing plugins. A role is a named bundle of capabilities, and a permission is one specific action, such as editing another author’s post. To manage them well, assign each person the lowest role that still lets them finish their work, and review those assignments regularly.

Key Takeaways

• WordPress documentation describes six predefined roles, from Super Admin to Subscriber, though a single-site install usually shows five in the Users screen.
• Administrators have full control, including installing plugins and changing settings, while Subscribers can only manage their own profile.
• You add a user by going to Users, then Add New, entering their details, and selecting a role.
• Role-based access control ties permissions to roles rather than individual people, which makes access easier to manage as team members change.
• A permission audit every few months, or after any staff change, catches accounts and capabilities that no longer match current responsibilities.

What Are User Roles and Permissions in WordPress?

A WordPress user role is a preset group of permissions that controls what a logged-in user can do in the dashboard. According to the WordPress Roles and Capabilities documentation, WordPress ships with six predefined roles, from Super Admin to Subscriber. Each role is made up of capabilities, which are the individual actions the system allows, such as publishing posts or managing users.

The idea behind this design is called role-based access control, or RBAC. The NIST Computer Security Resource Center glossary defines RBAC as a model in which permitted actions on resources are tied to roles rather than to individual user identities. In practice, you do not grant rights to Jane or Sam one at a time. You assign Jane and Sam to a role that already contains the rights they need.

The Six WordPress User Roles Explained

WordPress has six predefined roles, but most single-site owners only see five of them in the Users screen. Super Admin is a network-level role that exists on WordPress Multisite, where one installation runs many sites. On a standard single site, the roles you will assign are Administrator, Editor, Author, Contributor, and Subscriber, in order from most to least access.

The table below summarizes what each role can do by default on a single site. Plugins and custom code can change these defaults, so check your own setup before you rely on them.

Notice the gap between Editor and Administrator. Editors can control the content on your site, but they cannot change the site itself. An Editor cannot install plugins, switch themes, or create other users, which is why Editor is often the right role for a content manager.

How to Add, Change, and Remove Users in WordPress

You add, edit, and remove users from the Users section of the WordPress dashboard, and only accounts with user management capability can do this. Assigning the correct role at the moment you create an account prevents most permission problems later.

1. Log in as an Administrator and go to Users in the left-hand menu.
2. Click Add New User (on some screens, Add New).
3. Enter a username, email address, first name, and last name, and choose a strong password or let WordPress send a setup link.
4. Select the role from the Role dropdown, then click Add New User.
5. To change a role later, open All Users, find the account, and edit the role under the user’s details.
6. To remove someone, hover over their name in the list and click Delete. WordPress asks whether to delete that user’s content or assign it to another account, so choose before you confirm.

Deleting a user is permanent for the account itself. If the person has left the team but their posts still matter, you can usually reassign their content to an Editor or Administrator instead of deleting it.

Why Role-Based Permissions Are Easier to Manage

Role-based permissions scale better than granting rights to each person separately. The NIST publication on RBAC features and motivations explains that users can be moved between roles without modifying the underlying access structure, which simplifies authorization management. When someone is promoted from Author to Editor, you change one role assignment rather than rebuilding their access by hand.

The model is not new. NIST’s RBAC project page notes that the model was formalized in 1992 by Ferraiolo and Kuhn and was later revised as INCITS 359-2012. WordPress applies the same principle: the role is the unit you manage, and the capabilities behind it are what the software checks each time a user acts.

How to Customize User Roles and Capabilities

You can change what a role can do when the five defaults do not match your team. Start with a role management plugin if you want a visual interface, or use custom code if you have a developer on hand. Either way, change one capability at a time and test with a real test account before you apply the change to everyone.

Using a Role Management Plugin

Role management plugins add a settings screen where you can edit existing roles, create new ones, and toggle individual capabilities. Popular examples include User Role Editor, Members, and Advanced Access Manager. Each has its own interface, so read the plugin’s documentation before you change a production site.

Install only one role plugin at a time, because two plugins editing the same roles can produce confusing results. Before you make changes, back up your site so you can restore the original settings if something breaks. If you need help choosing a backup tool, see our guide to WordPress backup plugins.

Adding Capabilities With Code

Developers can add or remove capabilities in code using the built-in WordPress functions add_cap() and remove_cap(), as described in the WordPress roles documentation. This approach suits custom sites because the changes live in a theme or plugin file that you can version and review. It is less friendly for beginners, since a typo can lock users out of features they need.

Best Practices for Assigning Permissions

Assign roles based on the tasks each person performs, not on their job title or seniority. Giving someone Administrator because they are trusted is a common mistake, since it also gives them the ability to change plugins, themes, and other users’ access.

Use this checklist when you set up or review your team:

• Give each person the lowest role that still lets them complete their tasks.
• Keep at most two or three Administrator accounts, and use an Editor account for day-to-day content work.
• Use Contributor for writers whose posts need review before they go live.
• Remove accounts for former staff, freelancers, and vendors as soon as their work ends.
• Require strong passwords and enable two-factor authentication for Administrators and Editors.
• Document who holds which role and why, so the next person can review the setup quickly.

How Often Should You Audit User Permissions?

Review user permissions every few months, and again whenever a team member joins, changes roles, or leaves. A permission audit compares each account’s current role with the work that person actually does. Outdated accounts and unneeded capabilities are the most common findings.

During each audit, check the Users list for accounts you no longer recognize, confirm that every Administrator still needs that level of access, and downgrade anyone whose responsibilities have shrunk. Also review any custom capabilities added through plugins or code. For broader hardening steps beyond user accounts, read our current WordPress security practices checklist.

Troubleshooting Common User Role Problems

Most user role problems come from a wrong role assignment, a conflicting plugin, or a stale cache. Work through these checks in order before you assume a bug:

• Confirm the user’s role in the user profile, not just in the Users list summary.
• Ask the user to log out completely and log back in, since existing sessions can keep old permissions.
• Review any custom or added capabilities, because a role may not include what you expect after a plugin update.
• Clear your site cache and any caching plugin cache, so you see the current settings.
• Temporarily revoke and reassign the role to reset the user’s access.

If a role change or plugin update appears to have removed content or broken the dashboard, restore from a recent backup rather than making more changes. Our guide on what to do if your WordPress site gets hacked explains how to respond if you suspect an account has been misused.

Frequently Asked Questions

What is the difference between an Editor and an Author?

An Author can publish and manage only their own posts, while an Editor can publish and manage posts written by anyone on the site. Editors also moderate comments, which Authors cannot do. Choose Author for a writer who manages their own work, and Editor for someone who oversees the whole content library.

Can a Contributor publish a post?

No. A Contributor can write and save drafts of their own posts, but they cannot publish them directly. An Editor or Administrator has to review and publish the post. This makes Contributor a good role for guest writers or new team members.

How do I give someone access without making them an Administrator?

Start with the Editor role, which covers most content work without access to plugins, themes, or settings. If that is still too little access, use a role management plugin to add only the specific capabilities the person needs. Avoid promoting anyone to Administrator just to solve a single permission gap.

What happens to a user’s posts when I delete their account?

WordPress asks you to either delete that user’s content or assign it to another user before the account is removed. If you choose to reassign, the posts stay live under the new author. Check the content first, because deleting the account with its content can remove published work permanently.

How many Administrators should a WordPress site have?

Keep as few Administrators as possible, usually one or two for a small site and a small trusted group for larger teams. Each Administrator can install plugins, change settings, and manage other accounts, so each extra account adds risk. Review the list during every permission audit.

Conclusion

Managing user roles and permissions in WordPress comes down to giving each person the lowest role that still lets them do their job. Know what the six roles can do, add and remove users through the Users screen, and customize capabilities only when the defaults truly do not fit. Audit permissions every few months, and your site stays secure and easy for your team to run.