---
title: WordPress user roles
canonical: https://wpsecurityninja.com/dictionary/wordpress-user-roles/
---
# WordPress user roles

User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.

Last updated: 2026-08-26

Also called: user roles, WordPress roles, capabilities

## Related terms

- [Least privilege](https://wpsecurityninja.com/dictionary/least-privilege/): Least privilege means each user and integration gets only the access required for their job, nothing more.
- [Privilege escalation](https://wpsecurityninja.com/dictionary/privilege-escalation/): Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- [Two-factor authentication (2FA)](https://wpsecurityninja.com/dictionary/two-factor-authentication/): Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- [Event logging](https://wpsecurityninja.com/dictionary/event-logging/): Event logging records security-relevant actions so you can see what changed and when.
- [Application passwords](https://wpsecurityninja.com/dictionary/application-passwords/): Application passwords are per-app credentials WordPress can issue so integrations authenticate without using your main password.

[Full guide](https://wpsecurityninja.com/wordpress-user-roles/)

## Why it matters for WordPress

Roles are how WordPress encodes trust. Misassigned roles are a common root cause of “someone changed the site and we do not know who.” Administrator can install plugins and edit code paths; Editor usually should not.

## How it shows up in practice

- Subscriber, Contributor, Author, Editor, Administrator (plus Super Admin on Multisite)
- Plugins adding custom roles (Shop Manager, Customer, SEO Editor)
- Capability checks in code: `current_user_can( 'manage_options' )`
- Authors can upload media; Contributors cannot publish or upload by default

## What to do

1. Learn the default role ladder before inventing custom ones.
2. Prefer Editor for content teams; reserve Administrator for people who install plugins.
3. Review roles after major plugin installs that add capabilities.
4. Pair privileged roles with 2FA.
5. Log role and capability changes so surprise admins are visible.

Full guide: [WordPress user roles](https://wpsecurityninja.com/wordpress-user-roles/).