Not all users are equal, regardless of the website platform you’re using. There are always going to be different levels of user privileges with access to differing types of features. WordPress users also have their own hierarchy, and you need to understand how it works if you want to keep your site safe and running smoothly.
Well-defined user roles are critical if you want to minimize human error. For example, you wouldn’t want anyone who signed up for your website to be able to edit or delete posts. That means you need a role solely for end-users, along with others with more permissions. Fortunately for you, WordPress already has those.
In this article, we’re going to talk about the default WordPress user roles and how they work. We’ll tell you what each type of user can do, then teach you how to configure roles on your website. Let’s do it!
Table of Contents
An Introduction to WordPress User Roles
Every user on your WordPress website has a specific role. In your case, that role is (or should be) the Administrator, which gives you full access to every feature the platform has to offer. There should only be one person with administrator privileges, due to security purposes. There are other roles too, such as Editor, Author, and Subscriber. Each one carries its own set of permissions, which means you can essentially limit the features those people have access to.
Overall, WordPress works using a very hierarchical structure. This is very common on multi-user platforms and software, for the following reasons:
- It protects your website. The fewer privileges other users have, the less damage they can do. For example, you wouldn’t want your authors making tweaks to the way your pages look or installing new plugins unchecked.
- It keeps things running smoothly. The default WordPress user roles are perfect if you’re planning on running a multi-author blog. They provide each user access to the features they need to do their work and nothing more, so you can hit the ground running.
For a real-world example of how WordPress user roles work, imagine an Author spots an error on another user’s post. Rather than be allowed to change that unencumbered, the user role doesn’t let Authors make changes to posts they didn’t create. In this case, they’d need to contact someone with a higher user role – such as an Editor or Administrator – and ask them to handle it.
While it’s true that giving this person the privileges they need to edit other users’ posts would save time, it’d also open you up to some potential problems. For example, you could potentially see Authors making unauthorized changes to posts, or deleting those they don’t like. This is ultimately the job of the Editors, which is why they’re higher up on the WordPress totem pole.
The same principle applies even if we’re talking about networks or companies running proprietary software – in short, having clear user roles is critical for operations to run smoothly.
The 6 Types of WordPress User Roles You Can Use
Out of the box, WordPress includes six default user roles you can assign. Let’s break down what they are, and their respective privileges.
1. Super Admin
As you may imagine, Super Admins are at the very top of the food chain. However, this type of user role isn’t all that common. It only exists on WordPress Multisite setups, where you’ll need one person in charge of the entire network. In case you’re not familiar with the term, Multisite is a WordPress feature that enables you to set up multiple websites using a single installation. Then, you can manage all those sites using a custom WordPress dashboard with a few extra tabs you don’t see on regular installations.
A Super Admin has a number of roles and responsibilities, such as the ability to add and delete sites on the network, and make changes to its settings. What’s more, they can:
- Manage every user on the entire network.
- Make changes to any website within the network.
- Choose the plugins and themes that sites on the network have access to.
- Update Multisite to a newer version of WordPress.
To sum things up, Super Admins can do anything they want within their network. This includes adding and deleting websites and managing each of those installations.
If you’re running a standard WordPress website, this will be your role, and it’s the highest one you can set. It gives you full access to all the features WordPress has to offer, except those related to Multisite.
Despite not sounding as cool as a Super Admin, this user role has a pretty impressive list of privileges to its name. You can upload, install, activate, and delete plugins and themes, and also create, edit, and delete posts and pages (and their respective categories, tags, and links). What’s more, you can also:
- Upload files to your website, and both import and export your WordPress data.
- Set up new user accounts, edit, and delete them.
- Moderate any comments on your website.
- Switch to another theme.
- Delete your website altogether.
As you can see, there’s no feature that Administrators don’t have access to. Moreover, this role is the only one that can edit the roles of others on your website. There can be more than one Administrator for a single WordPress website, but it’s not something we recommend unless you’re working on a joint venture, since it can lead to problems (both technical and personal).
We’re moving past the realm of administrative user roles, and on to regular types of accounts. Since WordPress was created as a blogging platform, its default user roles are oriented towards those types of websites. This means Editors are right below Administrators regarding the privileges the role offers. Let’s talk about what this type of account can do:
- Create, edit, publish, and delete pages and posts – regardless of who set them up.
- Manage categories and links.
- Moderate your website’s comments.
- Upload files.
As you can see, this type of account doesn’t have access to any features not related to content management. Editors can’t install or deactivate plugins or themes, for example. Nor do they have access to user management. At first glance, it might not look like they have a lot of responsibilities, but managing multiple authors can be quite challenging.
On large blogs, Administrators often focus on keeping things running smoothly from a technical standpoint. They also oversee the quality of posts and make any changes they deem necessary to each page. This leaves Editors to polish the content Authors and Contributors create.
Authors are at the core of every blog. If you’re running a WordPress blog with you as the sole content creator, you don’t need a dedicated Author account. However, as your website grows, you’ll probably want to add team members to your stable, and that’s when you’ll be able to take advantage of the dedicated and specific user roles.
As you might imagine, Authors are even more limited than Editors when it comes to privileges. However, they do have access to all of the permissions they need to create and publish content, such as the ability to:
- Create, edit, and delete posts.
- Upload files (such as media) for their posts.
- View other author’s articles and pages.
- Tweak their own published posts.
As we discussed, Authors can only edit their own work. However, they can view posts that aren’t their own, even unpublished ones. Furthermore, they have access to media uploading features, in order to add images to posts.
Keep in mind – you should only assign the Author user role to fairly permanent team members. For temporary content creators, there’s another role that’s better suited to their needs.
If you run a blog with occasional guest posts (or have a high turnover of temporary writers), you’ll want to set them up with Contributor accounts. This user role offers fewer privileges than Author accounts, which makes it ideal for one-off situations. Let’s talk about what this user role can do:
- Create new posts, edit, and delete them.
- Read posts by other authors.
That’s pretty much it. Contributors can’t even publish posts without the approval of an Editor or higher. The main difference between Authors and Contributors is the former can publish their own posts. Most articles should still go through an Editor before your visitors can read them, though, although the privilege is there if needed.
This is the most limited user role WordPress offers. Subscribers can sign up to your site and have their own profile. However, they can’t interact in any way with unpublished posts, and have no means to create content. Let’s break down the privileges this user role has access to:
- Sign up, create, and edit their profile.
- Read published posts.
- Comment on posts and pages without having to sign in every time.
Visitors don’t need to sign up to your website to read your published posts. However, if you choose to let people sign up, they’ll be able to comment on your posts without having to. In addition, WordPress enables you to send newsletters to your Subscribers so you can reach out to them for important news.
How to Set and Edit User Roles in WordPress
Given the way WordPress works, you don’t need to worry about user roles if you’re running an entire website on your own. While installing the platform, you’ll also set up your Administrator account, which is the one you use to log into your dashboard.
Every new user who signs up afterward will default to a Subscriber user role. If you want to set up Editors, Authors, and Contributors, you’ll have to change those user roles manually. To do so, log into your WordPress dashboard and look for the Users > All Users tab. Inside, you’ll find a list of all the accounts on your website:
If you’d like to change user roles, simply tick the box next to the Username name, and go to the drop-down menu that says Change role to…:
Now choose the role from the list and click on the Change button next to it. The page will update, and that’s it – you’ve correctly set a new user role for your chosen user, which will come into force immediately:
You can also set up brand new accounts for your Editors, Authors, or Contributors. Simply click on the Add New button at the top of the Users tab:
On the next page, you’ll have to pick a Username for the new account and enter an email for it. WordPress will create a default password for the account, but you can also type one manually and ask the new user to update it later. Either way, remember to tick the Send the new user an email about their account box, so they receive a notice:
Finally, note the Role drop-down menu at the bottom of the page. You can use it to set any role you want for your new author before saving the new account. This method will come in handy if you choose to disable WordPress registrations by default (which is the default setting for new 000Webhost websites).
If you want to enable registration, you can do so by going to the Settings > General tab, ticking the box that says Anyone can register, then saving your changes:
Right below that option, you’ll notice a drop-down menu enabling you to change the default role for new users. We wholeheartedly recommend you don’t change it to anything besides Subscriber to avoid giving new users more privileges than they should have.
How to Create and Edit User Roles in WordPress Using Plugins
The great thing about WordPress is that you can tweak the platform in almost any way you want. For example, you can customize the default permission for your current WordPress user roles. While you could do this manually (which would be tricky), using a plugin that’s custom-made for the job, such as User Role Editor, is a great alternative:
This plugin enables you to customize the privileges for any user role except Administrators. What’s more, you can use it to create new custom user roles. In fact, some plugins (such as bbPress or WooCommerce) includes some kind of custom user role, as do a majority of the plugins that make inherent changes to WordPress’ functionality.
For now, let’s focus on User Role Editor. You can install it by going to the Plugins tab on your dashboard and clicking on Add new. Then use the search bar to the right to find the plugin and click on the Install Now button next to its name:
Once WordPress downloads and sets up the plugin, the Install Now button will be replaced by one saying Activate. Click on it, and once you receive a success notification, go to the new User Role Editor tab under Users. Inside, you’ll find a drop-down that enables you to choose which user role you want to edit:
You’ll also want to tick the box that says Show capabilities in human readable form, which will make the whole process simpler. Now, you can pick and choose the privileges you want the user role to have from the corresponding list:
There are way too many capabilities on the list to discuss here. However, a good rule of thumb is to never provide an account privilege you don’t understand, or give too many of them to Subscribers.
If you want to test the plugin without breaking anything, we suggest creating a new user role just for that purpose. You can do so by clicking on the Add Role button to the right of the screen:
You can pick a new name for your role now, and choose if you want to use an existing one as a template for its starting privileges:
We recommend starting with a clean slate, so you can look around and see all the privileges you can add. When your role is ready, you can choose the privileges you’d like to include, then click on the Add Capability button to the right to save your changes.
Understanding WordPress user roles is key for keeping your website running smoothly. Ideally, there should only be one person with full rights to the entire installation. Simple hierarchies work even for large-scale blogs and other types of websites, and WordPress makes setting them up simple.
This post has discussed what WordPress user roles are, and how they interact with one another. We’ve also broken down each user role in turn, including the Super Admin role for Multisite installations. Finally, we’ve shown you how to create, edit, and delete user roles – and even create custom ones – using a combination of WordPress’ built-in functionality and a dedicated plugin.
Do you have any questions about how WordPress user roles work? Let’s talk about them in the comments section below!