What are user roles?#

WordPress has several ready-made roles to control access. Each user gets one role and can only do what that role permits.

Main roles#

  • Administrator: all permissions, including installing plugins and deleting users
  • Editor: manages all posts and pages
  • Author: writes and publishes their own posts
  • Contributor: writes without permission to publish
  • Subscriber: can only log in and view their own profile

Example#

In an online magazine, the editor-in-chief gets the Editor role, guest writers have the Contributor role so they can submit articles for the editor to publish, and the technical manager holds the Administrator role. WooCommerce also adds roles such as "Customer" and "Shop manager".

Why does it matter?#

The principle of least privilege means giving each person only as much access as their job requires. If one colleague's account is hacked, the damage stays limited.

Customizable#

With a plugin you can create new roles or edit what roles can do, for example a "Support" role that can only see orders.

Common mistake#

Giving the Administrator role to all colleagues, or leaving a contractor developer's account active for years after their work ended.