Giving someone access to WordPress shouldn’t mean handing over the keys to the entire site. The WordPress roles and permissions are meant to restrict each account to the tasks it actually needs to perform: publish a post, proofread copy, manage comments, or administer the site.
The rule to follow is simple: assign the lowest level of access that allows the person to do their job. This principle of least privilege is recommended in the WordPress plugins user guide. It reduces the risk of accidental changes and makes access management easier over time.
What’s the difference between a role and a permission?
In WordPress, a role is a set of predefined permissions. A permission, also called a capability, corresponds to a specific action, such as editing a post, publishing content, uploading an image, managing plugins, or changing site settings.
For example, the Author role has the permissions needed to create, publish, and edit their own posts, but not someone else’s. The Editor role can manage content from multiple authors. WordPress includes six built-in roles: Super Admin, Administrator, Editor, Author, Contributor, and Subscriber. The official roles and capabilities documentation lists the rights associated with each.
A role therefore doesn’t describe a person’s status in your organization. It describes their concrete responsibilities on the site. A business owner doesn’t automatically need the Administrator role if they only have to approve and publish posts.
Which role should you give each user?
| Profile | Recommended role | Primary access |
|---|---|---|
| Site technical lead | Administrator | Manage users, settings, themes, plugins, and updates. |
| Content or communications lead | Editor | Create, edit, publish, and delete content, including that of other users. |
| Writer who publishes their texts | Author | Create, publish, and manage their own posts, and upload media. |
| Writer whose texts must be approved | Contributor | Write and edit their drafts, without publishing or uploading files by default. |
| Member, client, or registered reader | Subscriber | Manage their profile and access site-configured restricted content. |
Administrator: reserved for technical management
On a single-site WordPress installation, the Administrator can manage settings, users, themes, plugins, and updates. They can also create or delete accounts. Reserve this role for the person who actually handles the site's technical maintenance.
Avoid assigning it to a writer, a content agency, or someone who only needs to update a page. Access to plugins and general options can have consequences far beyond content. Before any technical intervention, plan a backup and a check: see the method for updating WordPress without breaking your site.
Editor: for managing publication
The Editor is suitable for the person responsible for content quality and publication. They can manage posts and pages, including those created by other accounts, administer categories, and moderate comments. However, they do not manage plugins, general settings, or users.
Give this role to the person who coordinates a blog, reviews texts from multiple contributors, or maintains the site's current pages. It's generally the right balance for someone responsible for communications.
Author: to publish their own posts
The Author can write, publish, edit, and delete their own published posts. They can also upload images and other permitted files. They cannot edit posts written by other users or manage the site's pages.
This role is useful when someone needs to publish their columns or news without going through internal approval. Before granting it, clarify your editorial process: a published post becomes visible according to the chosen visibility settings.
Contributor: to submit a text for approval
The Contributor can create and edit their own posts but cannot publish them. An Editor or Administrator must therefore review and publish the text. By default, this role also does not allow uploading media.
Prefer it for an occasional writer, a guest, or anyone who provides content without controlling the final publication. If images are needed, they can be sent separately to the publishing team rather than automatically increasing the account's rights.
Subscriber: an account without management access
The Subscriber can essentially manage their own profile. They cannot write or administer content. This role is useful when a site requires visitors to log in, for example to access a restricted area, comment according to site settings, or view private content.
And the Super Admin role?
The Super Admin refers to WordPress multisite installations, meaning a network that groups multiple sites under a single installation. This role can administer the network, its sites, and its settings at scale. On a WordPress site single site, you normally won’t need to use it or look for it in the list of roles.
How to assign a role without making a mistake
- In the WordPress admin, open Users, then Add to create an account or All Users to edit an existing account.
- Use an individual email address and avoid shared accounts. That way you can tell who made a change and revoke access without affecting others.
- Select the least permissive role that meets the current need.
- Ask the person to confirm they can complete their task without giving them access to menus they don’t need.
- Review accounts when responsibilities change or a collaboration ends.
Access allocation should be planned when the site is created. You can incorporate it into your process by following the steps to create a WordPress site gradually.
Beware of plugins that add permissions
Built-in roles are a foundation, but a plugin can add its own roles or permissions. An e-commerce, forms, booking, or membership plugin can create specific rights to manage its data. So check access within the plugin itself before inviting a new user.
When standard roles don’t match your workflow, you can create custom roles and add or remove capabilities. The roles and capabilities guide for developers explains this model and the functions to customize it. Because these changes can depend on a plugin or custom code, document them before applying.
I recommend starting with the built-in roles and creating a custom role only when a specific need can’t be met otherwise. To avoid adding tools that are hard to maintain, also see how to choose the right WordPress plugins.
Access checklist
- Create one account per person; never share an Administrator login.
- Reserve the Administrator role for the technical and structural management of the site.
- Choose Editor for someone who reviews or publishes everyone's content.
- Choose Author for someone who publishes their own posts.
- Choose Contributor when each post must be approved.
- Choose Subscriber for a registered visitor with no management tasks.
- Review accounts and roles regularly, especially after a change in your team.
Properly allocating WordPress roles and permissions reduces preventable mistakes while giving each person access appropriate to their responsibilities. This measure complements the practices presented in this guide to securing your WordPress site.