---
title: WordPress user roles
canonical: https://wpsecurityninja.com/dictionary/wordpress-user-roles/
---
# WordPress user roles

User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.

[Full guide](https://wpsecurityninja.com/wordpress-user-roles/)

## Why it matters for WordPress

Roles are how WordPress encodes trust. Misassigned roles are a common root cause of “someone changed the site and we do not know who.” Administrator can install plugins and edit code paths; Editor usually should not.

## How it shows up in practice

- Subscriber, Contributor, Author, Editor, Administrator (plus Super Admin on Multisite)
- Plugins adding custom roles (Shop Manager, Customer, SEO Editor)
- Capability checks in code: `current_user_can( 'manage_options' )`
- Authors can upload media; Contributors cannot publish or upload by default

## What to do

1. Learn the default role ladder before inventing custom ones.
2. Prefer Editor for content teams; reserve Administrator for people who install plugins.
3. Review roles after major plugin installs that add capabilities.
4. Pair privileged roles with 2FA.
5. Log role and capability changes so surprise admins are visible.

Full guide: [WordPress user roles](https://wpsecurityninja.com/wordpress-user-roles/).