What are user roles and permissions in WordPress?

User roles and permissions in WordPress control what each person who logs into your site is allowed to do. A role, such as Administrator, Editor, Author, Contributor, or Subscriber, is simply a named bundle of permissions, which WordPress calls capabilities. Capabilities are individual actions like edit_posts, publish_posts, or manage_options, and WordPress checks them every time a user tries to do something.

If you run a site with more than one person involved, whether that's a co-author, a freelance developer, or a team of editors, understanding roles is essential for keeping your site secure and your workflow organized. This article explains each default role, how capabilities work behind the scenes, how to assign and change roles, and how to create custom roles with plugins or code.

What Are WordPress User Roles?

A user role defines a set of tasks a user can perform on your WordPress site. Every user account is assigned at least one role, and that role determines which menus they see in the dashboard and which actions they can take.

WordPress uses a role-based access control system. Instead of granting permissions one by one to each user, you assign a role, and the user inherits all of that role's capabilities. This makes managing a site with many users much simpler.

What Are Capabilities?

Capabilities are the individual permissions that make up a role. Each capability represents a specific action. Some examples:

• read: Access the dashboard and view their own profile.
• edit_posts: Create and edit their own posts.
• publish_posts: Publish their own posts.
• edit_others_posts: Edit posts written by other users.
• upload_files: Upload media to the Media Library.
• moderate_comments: Approve, edit, and delete comments.
• manage_categories: Create and manage categories and tags.
• edit_theme_options: Customize menus, widgets, and the Site Editor.
• install_plugins: Install new plugins.
• manage_options: Change site settings under the Settings menu.
• list_users and promote_users: View users and change their roles.

When a user tries to perform an action, WordPress (and well-written plugins) check whether that user has the required capability. If they don't, the action is blocked or the menu item simply doesn't appear.

The Default WordPress User Roles

WordPress comes with five default roles on a single site, plus a sixth role on multisite networks. They're ordered roughly from most to least powerful.

Super Admin

The Super Admin role only exists on WordPress Multisite networks. A Super Admin can manage every site on the network and network-wide settings, including:

• Creating and deleting sites in the network.
• Installing themes and plugins for the whole network.
• Managing all users across all sites.
• Changing network-level settings.

On a multisite network, regular site Administrators can't install plugins or themes; only Super Admins can.

Administrator

On a single WordPress site, the Administrator has full control. Administrators can:

• Install, activate, update, and delete plugins and themes.
• Edit theme files (unless file editing is disabled).
• Change all site settings.
• Add, edit, and delete users, including other Administrators.
• Create, edit, publish, and delete any content.

Because Administrators can do anything, you should give this role to as few people as possible, ideally only the site owner and a trusted technical lead.

Editor

Editors are in charge of content. They can:

• Create, edit, publish, and delete any posts and pages, including those written by other users.
• Moderate comments.
• Manage categories and tags.
• Upload files.

Editors can't change site settings, install plugins or themes, or manage users. This makes the Editor role ideal for content managers and senior writers who oversee other contributors.

Author

Authors manage their own content. They can:

• Write, edit, publish, and delete their own posts.
• Upload files and add images to their posts.
• Edit their own published posts later if they need to make corrections.

Authors don't have the moderate_comments capability, so they can't manage comments across the site.

Authors can't edit or delete other users' posts, and they can't create pages. This role suits trusted regular writers who don't need to touch anyone else's work.

Contributor

Contributors can write but not publish. They can:

• Create and edit their own posts.
• Submit posts for review.

Contributors can't publish posts, upload files, or edit posts after they've been published. An Editor or Administrator must review and publish their work. This role works well for guest writers, new team members, or freelancers.

Subscriber

Subscribers have the most limited role. They can:

• Log in to the site.
• Manage their own profile (name, email, password).
• Read content, which matters on sites that restrict certain content to logged-in users.

Subscriber is commonly used as the default role for sites that allow public registration.

Quick Comparison of Default Roles

Here's a simplified overview of what each role can do on a single site:

Capability	Administrator	Editor	Author	Contributor	Subscriber
Read content and edit own profile	Yes	Yes	Yes	Yes	Yes
Write own posts	Yes	Yes	Yes	Yes	No
Publish own posts	Yes	Yes	Yes	No	No
Upload files	Yes	Yes	Yes	No	No
Edit others' posts	Yes	Yes	No	No	No
Manage pages	Yes	Yes	No	No	No
Moderate comments	Yes	Yes	No	No	No
Install plugins and themes	Yes	No	No	No	No
Manage users and settings	Yes	No	No	No	No

How to Assign or Change a User's Role

You can set a role when creating a user or change it any time afterward.

Changing One User's Role

1. Go to Users > All Users.
2. Hover over the user's name and click Edit.
3. Scroll to the Role dropdown and choose a new role.
4. Click Update User.

Changing Roles in Bulk

1. Go to Users > All Users.
2. Tick the checkboxes next to the users you want to update.
3. Use the Change role to... dropdown above the list.
4. Click Change.

Setting the Default Role for New Registrations

If you allow people to register on your site, you can control which role they receive:

1. Go to Settings > General.
2. Find New User Default Role.
3. Choose a role, usually Subscriber.
4. Click Save Changes.

Never set the default role to Administrator or Editor on a site with open registration. This is a common and serious security mistake.

Why User Roles Matter for Security

Assigning roles carefully is one of the simplest ways to protect your site. Follow the principle of least privilege: give each user only the capabilities they need to do their job.

• Limit Administrators: Every Administrator account is a potential target. If someone only writes content, they don't need admin access.
• Use temporary access: Give developers or support staff access for as long as they need it, then downgrade or remove the account.
• Review users regularly: Remove accounts for people who no longer work on the site.
• Pair roles with strong authentication: Require strong passwords and consider two-factor authentication, especially for Administrators and Editors.
• Disable file editing: Add define( 'DISALLOW_FILE_EDIT', true ); to wp-config.php to prevent anyone from editing plugin and theme files from the dashboard, even Administrators.

How to Customize User Roles With a Plugin

The default roles cover most sites, but sometimes you need something in between. For example, you might want Editors to manage menus, or you might need a "Shop Manager" style role for a specific plugin. Role management plugins make this easy without code.

Well-known options include:

User Role Editor: Lets you add or remove capabilities from existing roles, create new roles, and assign multiple roles to a single user.

Members: A long-running plugin (now maintained by the MemberPress team) for managing roles and capabilities, with content permissions for restricting posts to certain roles.

PublishPress Capabilities: Offers a clear interface for editing capabilities, including those added by plugins like WooCommerce, plus options to control admin menu visibility per role.

Typical Workflow

1. Install and activate your chosen plugin.
2. Open its role editor, usually found under Users in the dashboard.
3. Select an existing role or create a new one, optionally copying capabilities from an existing role as a starting point.
4. Tick or untick capabilities as needed.
5. Save and test by logging in as a user with that role.

Always back up your database before making major role changes. Roles are stored in the wp_user_roles option, and a mistake, such as removing capabilities from the Administrator role, can lock you out of parts of the dashboard.

How to Manage Roles and Capabilities With Code

Developers can manage roles directly using WordPress functions. Roles are saved to the database, so code that adds or changes roles should run once, typically on plugin activation, rather than on every page load.

Creating a Custom Role

This example creates a "Content Reviewer" role that can read and edit others' posts but not publish them. Place it in a custom plugin file:

<?php
/**
 * Plugin Name: Sajjad Custom Roles
 * Description: Adds a Content Reviewer role.
 */

if ( ! defined( 'ABSPATH' ) ) {
    exit;
}

function sajjad_add_custom_roles() {
    add_role(
        'content_reviewer',
        __( 'Content Reviewer', 'sajjad' ),
        array(
            'read'              => true,
            'edit_posts'        => true,
            'edit_others_posts' => true,
            'edit_private_posts' => true,
            'read_private_posts' => true,
            'moderate_comments' => true,
        )
    );
}
register_activation_hook( __FILE__, 'sajjad_add_custom_roles' );

function sajjad_remove_custom_roles() {
    remove_role( 'content_reviewer' );
}
register_deactivation_hook( __FILE__, 'sajjad_remove_custom_roles' );

When you activate the plugin, the role is created. When you deactivate it, the role is removed. Users who had that role will need to be reassigned.

Adding a Capability to an Existing Role

To let Editors manage menus and widgets (which require edit_theme_options), you can add the capability on activation:

function sajjad_editor_theme_options() {
    $role = get_role( 'editor' );

    if ( $role ) {
        $role->add_cap( 'edit_theme_options' );
    }
}
register_activation_hook( __FILE__, 'sajjad_editor_theme_options' );

Remember that this also gives Editors access to the Site Editor in block themes, since it relies on the same capability. Remove it later with $role->remove_cap( 'edit_theme_options' );.

Checking Capabilities in Your Code

When building features, always check capabilities rather than role names. Roles can be customized, but capability checks stay reliable:

<?php
if ( current_user_can( 'edit_others_posts' ) ) {
    echo '<a href="' . esc_url( admin_url( 'edit.php?post_status=pending' ) ) . '">';
    esc_html_e( 'Review pending posts', 'sajjad' );
    echo '</a>';
}

For object-specific checks, pass the object ID, for example current_user_can( 'edit_post', $post_id ). This uses WordPress's meta capability mapping to determine whether the user can edit that particular post.

Managing Roles With WP-CLI

WP-CLI includes commands for roles and capabilities:

# List all roles
wp role list

# Create a new role
wp role create content_reviewer "Content Reviewer"

# Add capabilities to a role
wp cap add content_reviewer read edit_posts edit_others_posts

# List capabilities for a role
wp cap list editor

# Change a user's role
wp user set-role jane editor

Primitive vs. Meta Capabilities

For developers, it's helpful to know WordPress has two kinds of capabilities:

• Primitive capabilities: Stored on roles, such as edit_posts or edit_others_posts.
• Meta capabilities: Context-dependent checks, such as edit_post (singular) for a specific post. WordPress maps these to primitive capabilities using map_meta_cap(), considering things like whether the user is the author and the post's status.

When you register custom post types, you can define their own capability types, so access to, for example, "Projects" can be controlled separately from regular posts.

Roles Added by Plugins

Many plugins add their own roles to fit their features. For example:

• WooCommerce adds Customer and Shop Manager roles.
• bbPress adds forum roles such as Keymaster and Moderator.
• SEO plugins such as Yoast SEO add roles like SEO Manager and SEO Editor.
• LMS and membership plugins often add roles for instructors or members.

When you deactivate these plugins, their roles may remain in the database. Role management plugins can help you clean up roles you no longer need.

---

FAQ: WordPress User Roles and Permissions

---

Conclusion

User roles and permissions are the backbone of how WordPress manages access. Each role bundles a set of capabilities, from the all-powerful Administrator down to the read-only Subscriber, and WordPress checks those capabilities every time a user tries to take an action. Understanding the differences between roles helps you assign the right level of access to each person on your team.

Start with the default roles, follow the principle of least privilege, and review your user list regularly. When your needs grow, role editor plugins or a few lines of code with add_role() and add_cap() let you tailor permissions precisely, keeping your site both secure and easy to manage.