Adding someone to WordPress is not merely an administrative task. The role you select determines what that person can publish, change, install, or potentially break.
A writer might need permission to publish their own articles but should not need access to plugins. An editor may need control over everyone’s content without being able to change the theme. A developer might require temporary administrative access while completing technical work.
WordPress handles these differences through roles and capabilities. Understanding both helps you give each person enough access to do their job without exposing unrelated parts of the website.
What Are WordPress User Roles?
A WordPress role is a predefined collection of permissions assigned to a user account. It does not describe a person’s job title; it describes what their account may do. A standard installation includes Administrator, Editor, Author, Contributor, and Subscriber. WordPress Multisite also has a network-level Super Admin role.
Themes and plugins can add roles or alter capabilities, so treat the defaults as a baseline and verify behavior on your own site.
What Do Capabilities Mean?
A capability is permission to perform a particular action, such as editing posts, publishing posts, moderating comments, uploading files, managing users, or installing plugins. Roles are bundles of capabilities. Developers should check the capability required for an action rather than assume that a particular role name always has it.
The official WordPress roles and capabilities documentation provides the detailed default reference.
Default WordPress Roles at a Glance
| Role | Typical use | Publishing access | Manages others’ content? | Technical administration? |
|---|---|---|---|---|
| Administrator | Site owner or technical manager | Yes | Yes | Yes |
| Editor | Editorial manager | Posts and pages | Yes | No |
| Author | Trusted regular writer | Own posts | No | No |
| Contributor | Supervised or guest writer | Cannot publish | No | No |
| Subscriber | Reader or account holder | None | No | No |
This is a simplified comparison. Plugins, Multisite rules, hosting restrictions, and custom code can change what is available.
Administrator
Administrator is the most powerful default role on a normal single-site installation. Administrators can generally manage all content and users, change settings, and install or update themes and plugins. Multisite, hosting controls, filesystem permissions, or configuration such as DISALLOW_FILE_MODS can restrict some file-management actions.
Reserve this role for the site owner, a trusted internal administrator, or a technical maintainer who genuinely needs broad control. A person should not receive it merely because choosing the correct lower role takes more thought.
Editor
Editors manage the publishing operation. They can normally create, publish, edit, and delete posts and pages, including content written by other users. They can also moderate comments, manage categories, and upload media.
They cannot normally install plugins, change themes, manage users, or alter core settings. Editor is suitable for a content lead who needs authority over the site’s material without technical administration.
Author
Authors create, edit, publish, and delete their own posts and can normally upload media. They cannot manage another writer’s posts, pages, users, plugins, themes, or site settings.
Use Author for a trusted regular writer who may publish independently. If every submission needs approval, Contributor is safer.
Contributor
Contributors write and edit their own posts but cannot publish them. Someone with suitable permission must review and publish the submission. By default, Contributors cannot upload files, which matters when a draft requires screenshots or photographs.
This role suits guest writers, volunteers, new team members, and students working under editorial supervision.
Subscriber
Subscribers can sign in, read material available to their account, and manage their own profile. They cannot create content or administer the site. A basic public website may not need Subscriber accounts at all; enable registration only for a clear purpose.
Practical Role Assignments
Small business
- Owner: Administrator
- Content manager: Editor
- Regular writer: Author
- Guest writer: Contributor
School publication
- Technical maintainer: Administrator
- Teacher or publication lead: Editor
- Experienced staff writer: Author
- Students submitting drafts: Contributor
Outside developer
Do not grant permanent Administrator access automatically. Define the work, confirm that a lower role will not suffice, create an individual account, make a backup, set an access-review date, and reduce or remove access when the task ends.
The broader WordPress website setup checklist covers related launch decisions.
Use the Principle of Least Privilege
Least privilege means giving each person only the permissions required for their current work. It is not about obstructing the team. It limits the effects of mistakes, compromised passwords, unapproved changes, and accounts that remain active after someone leaves.
Start with the lowest practical role. Increase access only when a real task requires it, and review the decision when responsibilities change.
Before Granting Administrator Access
- Confirm that the person genuinely needs technical control.
- Check whether Editor or Author covers the work.
- Create an individual account instead of sharing a login.
- Use a strong, unique password and multifactor authentication where supported.
- Verify that a current backup and recovery route exist.
- Set an end or review date for temporary access.
- Ensure another trusted recovery path exists for administrative access.
How to Review or Change a User’s Role
- Open Users → All Users.
- Find the relevant account.
- Open its profile or select it in the user list.
- Choose the appropriate role.
- Save the change.
- Confirm that the user can complete required work but cannot access unrelated areas.
Review accounts when someone joins, changes responsibilities, finishes a contract, or leaves. Before deleting an account, decide whether its content should be reassigned.
When Custom Roles Are Useful
A custom role may be appropriate when a repeated workflow falls between the defaults—for example, a writer who needs uploads but not publishing, or a staff member who manages one custom content type without accessing plugins.
Custom capabilities can be implemented with maintained code or a reputable role-management plugin. Back up first, document every change, test with a non-administrator account, and confirm what happens if the plugin is disabled. Never experiment by removing capabilities from the only working Administrator.
Common Permission Mistakes
Giving everyone Administrator access
This removes the boundary between editorial and technical work and increases the impact of every compromised account.
Sharing one administrator login
Shared credentials obscure accountability and make access removal difficult.
Using Author when review is required
Authors publish their own posts. Use Contributor when editorial approval must happen first.
Forgetting inactive accounts
An unused account remains a possible entry point. Remove it or reduce its role when it is no longer required.
Assuming roles never change
Plugins can introduce capabilities and screens. Test what each role can actually do on the current site.
Practical Permission Checklist
- Every person has an individual account.
- Each user has the lowest role that supports current work.
- Only trusted technical users have Administrator access.
- Contributors are used when publication requires approval.
- Privileged accounts use strong, unique passwords.
- Temporary access has a review or removal date.
- Former staff and contractors no longer have active access.
- Content is reassigned before an old account is deleted.
- Custom roles are documented, backed up, and tested.
- Plugin-added capabilities are included in reviews.
Frequently Asked Questions
Can an Editor install plugins?
Not by default. Editors manage content, not plugins, themes, users, or core settings.
Can an Author edit another writer’s posts?
Not by default. Authors manage their own posts; Editors and Administrators have broader editorial control.
Can a Contributor upload images?
The default Contributor role cannot upload files. An Editor can add media during review, or the site can implement a carefully tested custom workflow.
Should a web developer receive Administrator access?
Only when the defined work requires it. Use an individual account, create a backup, and reduce or remove access afterward.
What is the difference between Administrator and Super Admin?
Administrator is the highest normal role on a single site. Super Admin controls a WordPress Multisite network.
Choose Access According to the Task
Use Administrator for trusted technical control, Editor for publishing oversight, Author for independent writers, Contributor for reviewed submissions, and Subscriber for basic account access. If none fits, define the missing requirement before creating a custom role.
The safest pattern is straightforward: individual accounts, the lowest practical permission level, regular reviews, and prompt access removal when responsibilities end.