What Are WordPress User Roles?
Updated 15 October 2026
Jump to section
WordPress user roles control what each logged-in person can do on your site, from full control down to writing a single draft. WordPress ships with six: Super Admin, Administrator, Editor, Author, Contributor, and Subscriber, each granting a default set of abilities. For safe staff access, give every person the lowest role that still lets them do their job, so a blog writer never holds the keys to the whole site.
What does a role actually control?
A role controls which tasks a user may perform, grouped into what WordPress calls capabilities. WordPress designed roles "to give the site owner the ability to control what users can and cannot do within the site" (WordPress.org, updated September 2026).
Each role bundles a set of capabilities, from publishing posts to installing plugins on a WordPress site.
WordPress frames roles as responsibilities rather than a strict rank. In practice, though, they form a ladder of access, with the Administrator at the top and the Subscriber at the bottom.
The six default roles
WordPress comes with six built-in roles, listed here from most access to least. The descriptions are WordPress's own.
| Role | What it can do (WordPress.org) | Typical use |
|---|---|---|
| Administrator | "access to all the administration features within a single site" | Owner or developer |
| Editor | "publish and manage posts including the posts of other users" | Content manager |
| Author | "publish and manage their own posts" | In-house blogger |
| Contributor | "write and manage their own posts but cannot publish them" | Guest writer |
| Subscriber | "can only manage their profile" | Members, commenters |
The sixth role, Super Admin, appears only on a WordPress Multisite network, where it controls the whole network of sites. On a normal single-site install there is no Super Admin, so the Administrator is effectively the top role.
Safe staff access means the least role that works
Give each person the lowest role that lets them do their job, and no higher. This is the principle of least privilege.
It is the single most useful rule for staff access on WordPress.
The reasoning is simple. Every account is a potential way in, and an Administrator account is the most valuable target of all.
A writer who only needs to draft posts should be an Author or Contributor, not an Administrator. Marketing staff who edit pages can be Editors.
Keep the number of Administrators as small as you can, ideally just the owner and whoever maintains the site. Fewer admins means fewer high-value targets, which is one reason weak or over-shared admin logins are a common route in why websites get hacked. Protect the admin accounts you keep with two-factor authentication.
Roles, handover, and staff leaving
Roles only stay safe if you keep the user list current, especially when people join or leave. An account left active after someone leaves is an open door nobody is watching.
When staff leave, delete or downgrade their account and change any shared passwords the same day.
When a project or vendor hands over, confirm you hold the top Administrator account yourself, so you own the site and are never locked out. A pattern we see is a previous provider refusing to transfer control even after a police report, and it usually starts with who holds the admin role.
Your handover checklist should list every account and its role, which is part of good website governance.
Frequently asked questions
How many administrators should a WordPress site have?
As few as possible, ideally one or two. On a single-site install, every Administrator can install plugins, change any setting, and add or remove other users, so each one is a major risk if compromised. Give the owner and the person who maintains the site Administrator access, and everyone else a lower role. A long list of admins is a common and avoidable weakness.
What role should I give a blog writer?
Give a blog writer the Author role if you trust them to publish, or Contributor if their work should be reviewed first. An Author can publish and manage their own posts. A Contributor can write and manage their own posts but cannot publish them. Neither can touch settings, plugins, or other people's content, which is exactly what you want.
What is the difference between Author and Contributor?
The key difference is publishing. An Author can publish their own posts and upload images. A Contributor can write and edit their own drafts but needs someone else to publish them, and usually cannot upload media. Use Contributor for guest or freelance writers whose work you want to review, and Author for trusted in-house writers who post regularly.
Can I create custom WordPress roles?
Yes. Beyond the six built-in roles, you can create custom roles with a specific mix of capabilities, usually through a user-role plugin or a developer. This helps when a person needs more than one role allows but less than the next one up, such as editing products without full admin access. Keep custom roles simple, or they become hard to track.
Someone left the company. What do I do with their account?
Delete or downgrade their WordPress account the same day they leave, and reassign their content if needed. WordPress lets you attribute their posts to another user when you delete the account, so nothing is lost. Also change any passwords they knew, especially shared admin logins. An active account belonging to someone who has left is one of the easiest oversights for an attacker to exploit.
Is Super Admin the same as Administrator?
Only on a Multisite network. Super Admin exists on WordPress Multisite, where it controls the whole network of sites. On a normal single-site install there is no Super Admin, and the Administrator holds the top level of access. Unless you run a Multisite network, Administrator is the most powerful role on your site.
Setting up roles that keep your site safe
Storming Solutions maintains and rescues WordPress sites for Malaysian businesses alongside our custom builds. Part of a clean handover is setting user roles correctly and making sure you own the top Administrator account. We will not leave your site with five admins and shared logins, because that is the setup we get called in to clean up.
Want your user list reviewed and tightened? Ask on WhatsApp or bring it to our web development work. We will map who has access to what, then cut it back to what each person actually needs.