Access Dictionary
WordPress user roles
Definition
User roles group capabilities that decide what each account can do in WordPress, from reading to full admin.
Also called: user roles, WordPress roles, capabilities
Why it matters for WordPress
Roles are how WordPress encodes trust. Misassigned roles are a common root cause of “someone changed the site and we do not know who.”
How it shows up in practice
- Subscriber, Contributor, Author, Editor, Administrator (plus Super Admin on Multisite)
- Plugins adding custom roles (Shop Manager, Customer, SEO Editor, and so on)
- Capability checks in code:
current_user_can( 'manage_options' ) - Authors can upload media; Contributors cannot publish or upload by default
What to do
- Learn the default role ladder before inventing custom ones.
- Prefer Editor for content teams; reserve Administrator for people who install plugins.
- Review roles after major plugin installs that add capabilities.
- Pair privileged roles with 2FA.
- Log role and capability changes so surprise admins are visible.
Full guide: WordPress user roles.
Go deeper
Want the full walkthrough?
This page stays short on purpose. The guide covers steps, examples, and what to check on a live WordPress site.
Open full guideRelated terms
Nearby ideas in the dictionary
- Least privilege Least privilege means each user and integration gets only the access required for their job, nothing more.
- Privilege escalation Privilege escalation is gaining higher access than intended, such as a subscriber becoming an administrator.
- Two-factor authentication (2FA) Two-factor authentication (2FA) requires a second proof of identity after the password, such as an app code.
- Event logging Event logging records security-relevant actions so you can see what changed and when.