WordPress user roles decide what each person can do on your site: who can publish, who can only write drafts, who can install plugins and who can just log in and read. Getting them right keeps your site secure and your workflow sane. Getting them wrong usually means one of two things: everyone is an Administrator, or someone cannot do their job and keeps asking for help.
Underneath every role is a list of capabilities, small permissions like publish_posts or upload_files. Roles are just named bundles of those capabilities, which is why you can adjust them or build your own.
Quick answer: WordPress has six default user roles: Super Admin (multisite only), Administrator, Editor, Author, Contributor and Subscriber. Each role is a set of capabilities. Give every user the lowest role that lets them do their work, and create a custom role with add_role() or a role editor plugin when none of the defaults fit.
The default WordPress user roles
Here is what each built-in role is designed for on a standard single-site install.
Administrator
Full control of a single site: install and delete plugins and themes, change settings, manage every user and edit any content. On a single site, Administrators can also post unfiltered HTML, including scripts. Keep the number of Administrators as small as possible.
Editor
Manages all content. Editors can publish, edit and delete any post or page, including other people’s, moderate comments, manage categories and tags, and upload files. They cannot change site settings, plugins, themes or users. This is the right role for a content lead or managing editor.
Author
Writes and publishes their own posts and can upload media. Authors can edit and delete their own published posts but cannot touch other people’s content or create pages. Good for trusted regular writers.
Contributor
Writes and edits their own posts but cannot publish them. Contributors submit posts for review, and an Editor or Administrator publishes. By default they also cannot upload files, which surprises many guest writers. Good for guest authors and new writers.
Subscriber
Can log in, read content and manage their own profile. Nothing else in the dashboard. Membership sites and course platforms often build on this role.
Super Admin (multisite only)
On a WordPress multisite network, the Super Admin manages the whole network: adding sites, installing plugins and themes network-wide and managing network users. On multisite, regular site Administrators lose some powers, such as installing plugins and posting unfiltered HTML, which move to the Super Admin.
WordPress roles and capabilities compared
This table shows the key differences between the default roles on a single site.
| Capability | Administrator | Editor | Author | Contributor | Subscriber |
|---|---|---|---|---|---|
| Read content and edit own profile | Yes | Yes | Yes | Yes | Yes |
| Write and edit own posts | Yes | Yes | Yes | Yes | No |
| Publish own posts | Yes | Yes | Yes | No | No |
| Upload media files | Yes | Yes | Yes | No | No |
| Edit and publish others’ posts | Yes | Yes | No | No | No |
| Create and edit pages | Yes | Yes | No | No | No |
| Moderate comments, manage categories | Yes | Yes | No | No | No |
| Install plugins and themes, change settings | Yes | No | No | No | No |
| Manage users | Yes | No | No | No | No |
For the complete capability list per role, see the official Roles and Capabilities documentation on WordPress.org.
Roles added by plugins
Many plugins register their own roles or capabilities. WooCommerce, for example, adds a Customer role for shoppers and a Shop Manager role that can manage products, orders and store settings without full Administrator access. SEO, LMS and membership plugins often add roles too. Check the Users screen after installing a large plugin so you know what new roles exist and who has them.
Choosing the right role: the least privilege rule
The safest approach is simple: give each person the lowest role that lets them do their work, and raise it only when there is a clear need. Every extra Administrator account is another password that could be phished or reused.
- Your developer or agency: Administrator while they work, then downgrade or remove the account when the job is done.
- Content manager: Editor.
- Staff writers: Author.
- Guest writers and freelancers: Contributor.
- Store staff on WooCommerce: Shop Manager rather than Administrator.
- Members and customers: Subscriber or Customer.
Pair sensible roles with strong passwords, two-factor authentication and regular account reviews. Our guide on how to secure your WordPress site covers the rest of the basics.
How to change a user’s role
- Go to Users > All Users in the dashboard.
- Tick the user, or several users, you want to change.
- Choose the new role from the Change role to dropdown above the list and click Change.
- To set the default role for new registrations, go to Settings > General and pick the New User Default Role. Leave this as Subscriber unless you have a specific reason.
How to create a WordPress custom user role
Sometimes no default role fits. Common examples: a client who should see reports but not edit content, an Editor who also needs to manage menus, or a reviewer who can read private posts. You have two options.
Option 1: use a role editor plugin
Role editor plugins give you a screen with every capability as a checkbox. You can clone an existing role, rename it and toggle capabilities. This is the easiest option for non-developers. Be careful with capabilities like edit_users, promote_users, install_plugins and unfiltered_html, which effectively grant administrator-level power.
Option 2: use add_role in WordPress code
Developers can register roles in a small plugin. Roles are saved to the database, so register them once on plugin activation rather than on every page load. This example creates a read-only Client Viewer role and gives Editors permission to manage menus and widgets:
<?php
/**
* Plugin Name: Custom Roles
*/
function tnc_custom_roles_activate() {
add_role(
'client_viewer',
'Client Viewer',
array(
'read' => true,
'read_private_posts' => true,
'read_private_pages' => true,
)
);
$editor = get_role( 'editor' );
if ( $editor ) {
$editor->add_cap( 'edit_theme_options' );
}
}
register_activation_hook( __FILE__, 'tnc_custom_roles_activate' );
function tnc_custom_roles_deactivate() {
remove_role( 'client_viewer' );
$editor = get_role( 'editor' );
if ( $editor ) {
$editor->remove_cap( 'edit_theme_options' );
}
}
register_deactivation_hook( __FILE__, 'tnc_custom_roles_deactivate' );A few points worth knowing:
add_role()does nothing if the role already exists. To change an existing custom role, remove it and add it again, or useadd_cap()andremove_cap().- Capability changes persist in the database even after you delete the code, which is why the deactivation hook cleans up.
- Users assigned to a removed role lose those capabilities. Move them to another role first.
The Roles and Capabilities chapter of the Plugin Handbook covers the full API.
Check capabilities, not role names
In your own code, check what a user can do rather than which role they have. That way custom roles work automatically:
<?php
if ( current_user_can( 'edit_others_posts' ) ) {
// Show the editorial tools.
}What user roles do not protect: your media files
This is the part many site owners miss. Roles control what people can do inside the dashboard and which content WordPress shows them. They do not, by default, protect files in your uploads folder. A PDF, video or download stored in wp-content/uploads can usually be opened by anyone who has the direct URL, whether they are logged in or not.
That matters if you sell downloads, share client documents or run a members area. Hiding a link on a members-only page is not the same as protecting the file behind it.
This is the problem WP File Access Manager was built for. It restricts access to media files by user, role, membership or WooCommerce purchase, so the file itself checks permissions instead of relying on the link staying secret. It works alongside your existing roles, including custom ones you create.
A quick role audit you can do today
- Open Users > All Users and filter by Administrator. Remove or downgrade any account that does not need it.
- Delete accounts for former staff, freelancers and agencies, reassigning their content to an active user.
- Check the default role for new registrations is Subscriber, or turn off open registration if you do not need it.
- Look for unfamiliar roles added by plugins and confirm who holds them.
- List any private files on your site and confirm they are actually protected, not just unlinked.
If your site needs more complex permissions, such as client portals, approval workflows or role-based dashboards, a small custom plugin is often cleaner than stacking several role plugins. Our WordPress plugin development team builds these when off-the-shelf options fall short.
Frequently asked questions
What are the default user roles in WordPress?
WordPress has six default roles: Super Admin (multisite only), Administrator, Editor, Author, Contributor and Subscriber. Each is a predefined set of capabilities, from full control down to read-only access.
What is the difference between an Editor and an Author in WordPress?
An Author can write, publish and manage only their own posts. An Editor can publish and manage everyone’s posts and pages, moderate comments and manage categories, but cannot change site settings or plugins.
Can a Contributor upload images in WordPress?
Not by default. Contributors lack the upload_files capability, so they cannot add media. You can grant it with a role editor plugin or by adding the capability in code.
How do I create a custom user role in WordPress?
Use a role editor plugin to clone and adjust an existing role, or register one in a plugin with add_role(), ideally on activation. Always grant only the capabilities that role needs.
Do WordPress user roles protect uploaded files?
No. Roles control dashboard actions and content visibility, but files in the uploads folder are usually reachable by direct URL. You need a file access plugin or server rules to restrict them.
How many administrators should a WordPress site have?
As few as possible, often one or two. Give other people the lowest role that covers their work and remove admin accounts for contractors when their work is finished.
