The moment your WordPress site grows beyond a one person project, you face an important question: how much power should each person get? Hand a writer full admin access and one wrong click can break your theme. Give an editor too little access and they cannot do their job. WordPress solves this with user roles, a simple system that controls exactly what each account can and cannot do.
This beginner friendly guide explains WordPress user roles and capabilities in plain language. You will learn what each of the five default roles can do, how to change a user’s role, and the security habits that keep your site safe when other people log in.
What Are User Roles and Capabilities?
Think of capabilities as individual permissions: publish posts, edit other people’s pages, install plugins, change themes, manage users. WordPress has dozens of these granular capabilities. A role is simply a named bundle of capabilities. Instead of ticking fifty checkboxes for every new team member, you assign them one role like Editor or Author, and WordPress applies the whole bundle at once.
Every WordPress installation ships with five default roles. They form a ladder of trust, from Subscriber at the bottom with almost no power, up to Administrator with complete control. Understanding this ladder is the foundation of safe team management on any site.
What Can an Administrator Do?
The Administrator role has every capability WordPress offers. Administrators can install and delete plugins and themes, edit theme and plugin code, change any setting, manage all users including other administrators, and delete the entire site’s content if they choose. On a standard single site installation, there is nothing an Administrator cannot do.
Because of this total power, the Administrator role should be rare. Most sites need only one or two administrators: the site owner and perhaps a trusted developer. Every extra admin account is an extra doorway into full control of your site, so hand this role out only when someone genuinely needs it.
What Can an Editor Do?
Editors manage content but cannot touch the site’s technical machinery. An Editor can publish, edit, and delete any post or page on the site, including content written by other users. They can moderate comments, manage categories and tags, and upload media files.
What Editors cannot do is equally important: they cannot install or update plugins and themes, cannot change site settings, and cannot manage users. This makes Editor the ideal role for a content manager or lead writer who runs the editorial side while the owner handles the technical side.
What Can an Author Do?
Authors are trusted writers with control over their own work. An Author can write, edit, publish, and delete their own posts, and upload their own media files. They cannot touch anyone else’s posts, cannot publish pages (only posts), and cannot moderate comments beyond their own.
This role suits regular contributors you trust to publish directly, such as staff writers on a blog or news site. They get independence over their own articles without any ability to alter someone else’s work or the site’s structure.
What Can a Contributor Do?
Contributors can write and edit their own posts, but they cannot publish them. Their articles stay in pending review status until an Editor or Administrator approves and publishes them. Contributors also cannot upload media files to the library, which surprises many beginners.
This is the perfect role for guest writers, new freelancers, or anyone whose work you want to review before it goes live. It gives you a clean editorial workflow: they draft, you review and publish. For a practical look at bringing writers on board safely, pair this with our guide on limiting login attempts in WordPress without a plugin to protect every account on your site.
What Can a Subscriber Do?
Subscribers have the least power of all. A Subscriber can log in, read content, update their own profile, and leave comments. They cannot write posts, upload files, or change anything on the site. This role exists mainly for membership style sites, forums, or shops where users need accounts but should never touch content creation.
If your site has no membership features, you can safely disable new user registration entirely under Settings, General. Fewer accounts means a smaller attack surface, which is always good security.
What Is a Super Admin on Multisite?
If you run WordPress Multisite, a network of many sites managed from one installation, there is one extra role: Super Admin. A Super Admin controls the entire network. They can create and delete sites, install plugins and themes network wide, and manage every user across all sites. On a multisite network, even a regular Administrator is limited to their own single site.
Most beginners will never need multisite, and the Super Admin role only appears there. If you run a single site, you can ignore it completely. The five standard roles are all you need.
How Do the Five Roles Compare?
Here is a quick comparison of the key capabilities across the five default roles, from most to least powerful.
| Capability | Administrator | Editor | Author | Contributor | Subscriber |
|---|---|---|---|---|---|
| Manage settings, plugins, themes | Yes | No | No | No | No |
| Manage users | Yes | No | No | No | No |
| Publish and edit anyone’s posts | Yes | Yes | No | No | No |
| Publish own posts | Yes | Yes | Yes | No | No |
| Write posts for review | Yes | Yes | Yes | Yes | No |
| Upload media files | Yes | Yes | Yes | No | No |
| Read content and comment | Yes | Yes | Yes | Yes | Yes |
How Do You Change a User’s Role?
Changing roles takes less than a minute. In your WordPress dashboard, go to Users, then All Users. Hover over the person whose role you want to change and click Edit, or tick the checkbox next to their name and choose Change role to from the bulk actions dropdown for several users at once.
On the edit screen, find the Role dropdown, select the new role, and click Update User. The change takes effect immediately: the next time that person logs in, their dashboard will show only the menus their new role allows. To add someone new with the right role from the start, go to Users, Add New User, fill in their details, and pick the role before clicking Add New User. If you are still learning your way around these screens, our WordPress dashboard guide for beginners walks through every menu.
Which Role Should You Give Your Team?
Matching the role to the job is where the system pays off. Here are the scenarios site owners run into most often.
- Hiring a freelance writer: start them as a Contributor so every article passes through your review. Promote proven writers to Author when you trust their judgment.
- Hiring a content manager or editor: the Editor role is made for this. They can run the whole publication workflow without touching plugins or settings.
- Hiring a developer for a small fix: resist giving permanent Administrator access. Create a temporary admin account, then delete it when the work is done, or use a staging site instead.
- Running a membership community: new members get the Subscriber role. They can participate without any risk to your content.
- Working with a co founder: only here does a second Administrator make sense, and only for someone you trust completely.
What Are the Security Best Practices for User Roles?
User accounts are one of the most attacked parts of any WordPress site. These habits keep the roles system working for you instead of against you.
- Follow the least privilege principle: give each person the lowest role that still lets them do their job. You can always upgrade later.
- Never hand out Administrator casually: plugin installers, SEO helpers, and one time freelancers almost never need full admin rights.
- Delete accounts you no longer need: old freelancer and ex employee accounts are forgotten backdoors. Remove them the day the work ends, and reassign their posts to your own account when WordPress asks.
- Use strong, unique passwords: every account, including lowly Subscribers, should have a long random password. WordPress can generate one for you on the user edit screen.
- Rename the default admin username: the classic
adminusername is the first guess in every brute force attack. Create a new administrator with a unique name, log in as the new account, and delete the oldadminuser. - Review roles regularly: once a quarter, open Users, All Users and check that everyone still has the role they need. Roles drift upward over time if nobody audits them.
For extra protection on the login screen itself, you can customize the WordPress login page without a plugin, which also lets you remove the default branding that tells attackers exactly what software you run. If you want to go deeper into how capabilities work under the hood, the official documentation at developer.wordpress.org covers the full capabilities list, and wordpress.org is the home of the project itself.
Frequently Asked Questions
Can I create a custom user role in WordPress?
Yes. The five default roles cover most needs, but plugins like User Role Editor let you build custom roles with hand picked capabilities, for example a “Shop Manager” who can manage orders but not touch blog posts. Only create custom roles when a default one genuinely does not fit.
Can one user have two roles at the same time?
WordPress assigns one primary role per user through the dashboard, but the underlying system supports multiple roles, and several plugins enable it. In practice, it is cleaner to give the higher of the two roles than to juggle combinations.
What happens to a user’s posts when I delete their account?
WordPress asks you to choose: attribute all of their content to another existing user, or delete their content along with the account. For departing team members, always reassign their posts to yourself or another editor so nothing valuable disappears.
Is it safe to give a plugin support agent the Administrator role?
Only temporarily and only to reputable companies. Create the admin account, let them do the work, then delete the account immediately afterward. Better still, reproduce the issue on a staging copy of your site so support never touches your live database.
Last updated: October 2026.
