WordPress User Roles Explained: Administrator, Editor, Author, Subscriber

As a WordPress site grows and more people start collaborating on it — writers, editors, marketers, developers, or even registered customers — one question becomes critical: who should be able to access what? That's exactly what WordPress's User Roles system is built to solve. Setting up permissions correctly isn't just about workflow convenience; it's the first line of defense for your site's security, since over-privileged accounts are exactly what attackers look to exploit.

Why User Roles Matter for Security and Team Management

WordPress was built around Role-Based Access Control (RBAC) from the ground up, allowing site owners to divide responsibilities and clearly limit what each person can touch. Rather than giving everyone who logs in equal access — which is genuinely risky — WordPress groups users by function, and each group sees a different set of menus and can perform a different set of actions.

The benefits fall into two categories. First, security — if a writer's account credentials get stolen, the attacker can only write or edit that writer's own posts. They can't delete plugins, switch themes, or remove other users. The damage stays contained. Second, team organization — editors know exactly whose drafts need review before publishing, freelance writers can focus purely on writing without worrying about technical settings, and site owners can trust that no one is touching settings they shouldn't.

WordPress's Default Roles Explained

WordPress ships with 5 core roles for a standard single site, plus one special role that only appears on WordPress Multisite installations.

1. Administrator

Administrator is the highest role on a single site, with essentially unrestricted access: install or delete plugins and themes, edit theme files through the built-in Theme Editor, manage every user including deleting accounts, change all site settings, import/export data, and of course manage every piece of content from every user. This role should normally be reserved for the actual site owner or a trusted system administrator only.

2. Editor

Editors control all content across the site, whether it's their own or someone else's: write, edit, delete, and publish posts and pages for every user, moderate all comments (approve, delete, reply), and manage categories and tags. However, Editors cannot access plugin settings, themes, or user management. This role fits a content team lead who needs to review other people's work before it goes live.

3. Author

Authors can write, edit, and publish their own posts immediately without waiting for approval. They can upload media attachments, but cannot edit or delete other users' posts, and cannot create new categories (they can only select from existing ones). This role suits a trusted regular contributor who's earned the ability to publish directly.

4. Contributor

Contributors can write and edit their own posts, but cannot publish them directly — finished drafts go into "Pending Review" status and wait for an Editor or Administrator to review and approve before going live. Contributors also cannot upload media attachments (like images) to the Media Library themselves; someone with a higher role needs to attach files on their behalf. This role is ideal for guest writers or freelancers whose work still needs an editorial checkpoint.

5. Subscriber

Subscriber is the lowest role — users can log in only to manage their own profile, change their password, and view member-restricted content. They have no ability to write or edit any content. This role suits sites that let readers register to comment or receive updates, and it's also the default role WordPress assigns to anyone who self-registers through the front end.

Super Admin — WordPress Multisite Only

Super Admin isn't a standard role you'll see on a typical single site — it only appears when WordPress Multisite (a network of multiple sites running on one installation) is enabled. Super Admins control the entire network: they can create or delete subsites, install network-wide plugins and themes, and manage users across every site in the network. It sits above the Administrator role of any individual subsite.

Comparison Table: What Each Role Can and Cannot Do

The table below summarizes the key capabilities you'll want to know when deciding which role to assign someone:

How to Assign or Change a User's Role

WordPress makes role management simple — no code required. There are two common scenarios:

Changing an Existing User's Role

1. Log into the WordPress admin dashboard with an Administrator account
2. Go to Users → All Users
3. Click the username you want to edit (or click "Edit" that appears on hover)
4. Scroll down to the "Role" field and select the new role from the dropdown
5. Click "Update User" at the bottom of the page

To change multiple accounts at once, select the checkboxes next to the usernames on the All Users page, choose "Change role to…" from the Bulk Actions dropdown above the table, then click "Change" — this saves a lot of time when managing larger teams.

Creating a New User with a Specific Role

1. Go to Users → Add New
2. Fill in the Username, Email, and other details as needed
3. Select the desired role from the "Role" dropdown before clicking "Add New User"
4. WordPress will email the new user a password setup link (if "Send User Notification" is enabled)

Security Risks of Over-Privileging Users

Security professionals consistently recommend the Principle of Least Privilege — give each person only the access they need to do their job, and nothing more. Here's why making everyone an Administrator is a serious risk:

• Larger attack surface — the more Administrator accounts exist, the more entry points attackers have to target with brute force or phishing attacks aimed at gaining full control.
• Bigger damage from leaked passwords — if one staff member reuses a password that's been leaked elsewhere, an attacker can log in with full Admin rights and potentially wipe out the entire site in a few clicks.
• Human error — non-technical staff might accidentally delete a critical plugin, switch themes unintentionally, or change a setting that breaks the site, with no malicious intent at all.
• Harder to audit — when everyone has the same level of access, tracing "who did what" after an incident becomes much harder, since anyone could have performed any action.

The right approach is to assign roles based on actual job function: writers get Author or Contributor, not Administrator; marketing staff handling SEO get Editor, not full access; and Administrator accounts are kept to the absolute minimum needed (typically 1-2 accounts for a standard site).

Creating Custom Roles and Capabilities

Sometimes WordPress's 6 standard roles don't fit every scenario — maybe you want Editors to edit posts but not delete comments, or you want to create a new "SEO Manager" role with access to only a few specific menus. This is where well-known free plugins in the WordPress ecosystem come in handy, such as User Role Editor and Members. Both provide a point-and-click interface for toggling individual capabilities without writing any code.

These plugins let site administrators:

• Create brand-new roles with custom names that don't exist by default
• Remove specific capabilities from existing roles (for example, removing comment-deletion rights from Editors)
• Add extra capabilities to any role (for example, letting an Author view the Plugins menu in read-only mode)
• Export/import role configurations to reuse across multiple sites

Developers comfortable with code can also use the add_role() and add_cap() functions in functions.php to define custom roles and capabilities programmatically. For non-technical users, though, a plugin is a much faster and safer route.

Bonus: Special Roles When Using WooCommerce

If your WordPress site has WooCommerce installed for selling products online, the plugin automatically adds new roles to support store operations:

Shop Manager

Shop Manager is a role WooCommerce creates specifically for staff running the store. It can:

• Manage all products (add/edit/delete/categorize)
• Manage orders, update shipping status, and issue receipts
• Create and manage discount coupons
• View sales reports and store statistics
• Moderate product reviews

However, Shop Manager cannot access plugin settings, themes, or Administrator-level user management — it's ideal for sales or warehouse teams who need to update products and orders daily without any risk of touching the rest of the site.

Customer

Customer is the role automatically assigned to shoppers who register through the storefront when placing their first order. They can only view their own order history, manage shipping addresses, and edit their personal account details — no access to the Admin Dashboard at all. It's essentially equivalent to Subscriber, with e-commerce-specific capabilities layered on top.

Best Practices Checklist for Managing User Roles

• Follow the Principle of Least Privilege — always grant only what's needed for the task
• Keep the number of Administrator accounts to a minimum (typically 1-2 for a standard site)
• Periodically review your user list and roles, removing accounts that are no longer active (e.g. former employees)
• Enforce strong passwords and enable Two-Factor Authentication, especially for Administrator accounts
• Never share a single login across multiple people — create individual accounts so actions can be traced back
• Use a custom-role plugin when the default roles don't fit, rather than over-granting access
• For WooCommerce, assign Shop Manager to sales staff, not Administrator
• Back up your site regularly in case a role change goes wrong or an account is compromised

Frequently Asked Questions

What is the difference between a User Role and a Capability?

A Role is a pre-defined bundle of Capabilities — for example, Editor includes roughly 30 capabilities. A Capability is a single permission, like edit_posts or delete_users. Administrators can further customize which capabilities belong to each role using a plugin such as User Role Editor.

Why shouldn't every team member be an Administrator?

Administrators can delete plugins, switch themes, remove other users, and edit files through the built-in editor with no restrictions. If an Administrator account is compromised or a staff member makes a mistake, the damage affects the entire site immediately. Following the Principle of Least Privilege limits the blast radius significantly.

What's the difference between Contributor and Author?

A Contributor can write and edit their own posts but cannot publish them directly — the post goes into Pending Review status and waits for an Editor or Administrator to approve it. An Author can write, edit, and publish their own posts immediately without needing approval.

How do I change an existing user's role?

Go to Users → All Users, click the username you want to edit, scroll to the Role field, choose the new role from the dropdown, and click Update User. To change multiple accounts at once, select the checkboxes and use Bulk Actions → Change role to.

What is Super Admin and how is it different from Administrator?

Super Admin only exists on WordPress Multisite. It's a network-level role that controls every subsite in the network, including installing/removing network-wide plugins and creating new sites. A regular Administrator only controls the single site they have access to.

How should I set up roles for WooCommerce store staff?

WooCommerce automatically adds a new role called Shop Manager, which can manage products, orders, coupons, and sales reports, but cannot access plugin, theme, or Administrator-level user settings. It's ideal for sales or warehouse staff who need daily store access without full site control.