WordPress User Roles: How to Give the Right Access Every Time
Written By: TaKenya
Published: June 25, 2023
Modified: October 28, 2026
The links in this post may be affiliate links. That means that if you click them and make a purchase, this site makes a commission. It will have no impact on the price you pay or the experience of your purchase.
When I start working on an existing website, one of the first places I look is the Users list and the WordPress user roles assigned to each account. More often than not, I find accounts the owner does not recognize. They do not know who those people are, why they need access, or when they were added.
Cleaning up users sits right next to auditing plugins on my list, because both are quiet security risks that build up over time. So let me walk you through WordPress user roles, which role fits which helper, and how to add and remove users the right way.
Why WordPress User Roles Beat Sharing Your Login
Every person who works on your website should have their own user account. Handing out your login might feel faster, but it creates problems you will not notice until something goes wrong.
You Can See Who Did What
When five people share one login, there is no way to tell who deleted a page or installed a plugin. Separate accounts tie every change to a person, so you know who to ask when something breaks.
You Can Remove One Person Without Changing Everything
If someone stops working with you, you delete their account and you are done. With a shared login, you have to change the password and then hand the new one out to everyone who still needs it.
Your Own Account Stays Yours
Your administrator login is usually tied to your email address and your ownership of the site. Keeping it private protects both. A password manager can help you share access safely when you need to, without giving away the actual password.
Here is what that means for you: you stay the owner, and everyone else is a user. If you want the bigger picture on owning your domain, hosting, and website, read Who Owns My Website? A Small Business Guide to Digital Ownership.
The Default WordPress User Roles
WordPress user roles are built-in permission levels that control what each person can do on your site. A standard WordPress site comes with five of them, and each one can do a little less than the one above it.
Administrator
Administrators can do everything. That includes installing plugins and themes, changing settings, adding and deleting users, and editing or deleting any content on the site.
Keep this role to as few people as possible. You, as the owner, should always have one.
Editor
Editors manage all of the content. They can publish, edit, and delete any post or page, including ones other people wrote, and they can moderate comments and manage categories and tags.
Editors cannot touch plugins, themes, settings, or users. That makes this a good fit for someone running your content without running your website.
Author
Authors can write, publish, edit, and delete their own posts, and they can upload images. They cannot edit anyone else’s posts, and they cannot create or edit pages.
Contributor
Contributors can write and edit their own posts, but they cannot publish them. Their posts wait for an editor or administrator to review and publish.
One thing that trips people up: contributors cannot upload images. They also cannot edit a post once it is published.
Subscriber
Subscribers can log in, update their own profile, and read content. They cannot create or change anything, so this role is mostly used for membership sites or private content.
What About Super Admin and Other Roles?
WordPress also has a Super Admin role, but it only applies to multisite networks, where one dashboard runs several sites. On a regular site, the administrator already has full control. You can read the full breakdown in the WordPress Roles and Capabilities documentation.
Plugins can add their own roles too. WooCommerce adds Shop Manager and Customer, and All in One SEO adds SEO Manager and SEO Editor, so do not be surprised if your Role dropdown has more than five options.
Which WordPress User Roles to Give To Who
The right role depends on what the person is actually doing, not on their job title. Give each person the lowest role that still lets them do their work.
Your Web Designer or Developer
Someone building or fixing your site usually needs administrator access, because their work involves plugins, themes, and settings. I request admin access when I work on a client site for exactly that reason.
If they are only publishing posts, though, they do not need admin. Author, editor, or contributor access will cover it.
Your Maintenance Provider
Whoever handles your updates, backups, and security needs administrator access to do that work. Make sure they have their own account under their own email, not a copy of your login.
Your Virtual Assistant or Content Manager
If someone uploads, formats, and publishes your posts and pages, the editor role fits. They can manage all of your content without being able to change how the site works.
A Guest Writer or Freelance Writer
Use author if you trust them to publish on their own. Use contributor if you want to review every post before it goes live.
A Client or Team Member Who Just Needs to Look
If someone only needs to see private content or a members area, subscriber is enough. For reviewing drafts, contributor is usually the better fit since subscribers cannot see the editor.
Think about it like this: you would not hand a new employee the keys to every room in the building. Give access for the job in front of them, and you can always raise it later.
How to Add a New User in WordPress
Adding a user takes about two minutes, and you need to be logged in as an administrator to do it.
Go to Users and Click Add New User
In your WordPress dashboard, hover over Users in the left menu and click Add New User. You can also click Users and then the Add New User button at the top of the page.
Fill In Their Details
The username and email address are required. Use the email address the person actually checks, because that is where their login link and password resets will go.
First name, last name, and website are optional, but adding a name makes it much easier to recognize the account later.
Set the Password
WordPress generates a strong password for you. You can leave it as is, since the person will set their own password from the email WordPress sends them.
Decide Whether to Send the Notification
Leave Send the new user an email about their account checked. That email includes a link for them to set their password, so you never have to send a password yourself.
Choose the Role
Pick the role from the Role dropdown based on what the person needs to do. The dropdown starts on your site’s default role, which you can find under Settings and then General, so always double check it before you save.
Click Add New User
Once you click the button, the new account shows up in your Users list. The person can log in as soon as they set their password.
How to Change or Remove a User
People’s roles change, and so do the people you work with. Your Users list should change with them.
Change Someone’s Role
Go to Users, hover over the person’s name, and click Edit. Scroll to the Role dropdown, pick the new role, and click Update User.
To change several people at once, check the boxes next to their names, choose a role from the Change role to dropdown at the top of the list, and click Change.
Remove Someone Who No Longer Needs Access
Hover over the person’s name in the Users list and click Delete. If they wrote any posts or pages, WordPress will ask what to do with that content.
Choose Attribute all content to and pick another user, usually you. If you choose to delete their content instead, every post and page they created goes with them.
Review Your Users List Regularly
Ask yourself three questions about every account: Do I know who this is? Do I know why they have access? Do they still need it? If the answer to any of them is no, it is time to change the role or remove the account.
I pair this check with a plugin audit, because forgotten plugins are the other thing that piles up quietly. If you want a starting point for that, read Best Practices for Using Plugins & Maximizing Your WordPress Potential. And if someone else set up or manages your site, 9 Things You Should Know Even If Someone Set Up or Manages Your WordPress Site covers what you should have access to yourself.
Keep Your Users List Clean
You do not need to memorize every permission. You just need to know who has access, why they have it, and whether they still need it.
Here is your next step: log in today, open your Users list, and run through those three questions for every account. Fix what you find before you add anyone new.
If you would rather not keep track of all this yourself, that is exactly what a WordPress Care Plan is for. We handle your updates, backups, and security checks, including keeping an eye on who has access to your site.
Want to talk through how your site and your team should be set up? Book a strategy session and we can map out who needs what together.
