User Roles
Quick Definition
WordPress user roles define what each person can and cannot do on your site. The five default roles — Administrator, Editor, Author, Contributor, and Subscriber — control access to content, settings, and features through a capability-based permission system.
What Are User Roles?
WordPress uses a role-based access control system to manage what each user can do on your site. Every registered user is assigned a role, and each role comes with a set of capabilities — specific permissions like "edit posts," "manage options," or "delete others posts." This system ensures that a blog contributor cannot accidentally (or intentionally) delete your entire site.
The 5 Default Roles
| Role | Can Do | Best For |
|---|---|---|
| Administrator | Everything — install plugins, change themes, manage users, edit settings, delete anything | Site owner (you) |
| Editor | Create, edit, publish, and delete any post or page. Moderate comments. Manage categories and tags. | Content managers, team leads |
| Author | Create, edit, publish, and delete their own posts only. Upload media files. | Regular writers, bloggers |
| Contributor | Write and edit their own posts but cannot publish. Cannot upload files. | Guest writers, interns |
| Subscriber | Read content and manage their own profile. No editing capabilities. | Registered readers, members |
Each role inherits all capabilities of the roles below it. On Multisite, there is a sixth role: Super Admin.
Security Best Practices
- Principle of least privilege — Give each user the minimum role they need
- Limit Administrator accounts — Only site owners should have Admin access
- Use Editor for content managers — Full content control without plugin/theme access
- Review accounts regularly — Remove inactive users, check for unknown accounts
Custom Roles and Capabilities
- User Role Editor — The most popular role management plugin
- Members — Custom roles + content restrictions
- Code —
add_role()andadd_cap()in functions.php
Why It Matters
User roles are a fundamental WordPress security feature. Properly assigning roles minimizes damage from compromised accounts. For multi-author blogs, agency sites, and membership sites, understanding roles is essential for both security and workflow.
Sources: Developer.WordPress.org, WordPress.org