TL;DR: WordPress ships with five built-in user roles — Administrator, Editor, Author, Contributor, and Subscriber — each backed by a granular set of capabilities you can read, add, or remove with code or a plugin. For most sites, the Members plugin or User Role Editor gives you full control without touching functions.php.
Last Updated: November 2026. Tested against WordPress 6.7 running PHP 8.3.
Every person who logs in to your WordPress site gets a role. That role is a named bundle of capabilities — individual permissions that tell WordPress exactly what that person can and cannot do. Get the roles right and your multi-author blog runs smoothly, your client cannot accidentally delete the wrong page, and your membership site serves the correct content to the correct subscribers. Get them wrong and you expose your site to insider mistakes or, worse, privilege-escalation attacks.
This guide covers every built-in WordPress user role, the capability system underneath them, and practical methods for customizing roles on membership sites, client sites, and multi-author blogs. Security best practices for limiting admin access are woven throughout.
How the WordPress Role and Capability System Works
Try GigaPress AI Free →
WordPress user roles and capabilities are stored in the wp_options table under the key wp_user_roles (the prefix may differ on your install). Each role is an array with a human-readable label and an array of capabilities mapped to true or false. When a user attempts an action, WordPress calls current_user_can( 'capability_name' ), looks up the current user’s role, and checks whether that capability is set to true.
This architecture means two important things. First, capabilities are not tied to roles at a database level — they live inside the role definition, so a user can hold capabilities that no standard role defines. Second, you can grant or revoke individual capabilities on a per-user basis, overriding the role default, using WP_User::add_cap() and WP_User::remove_cap().
The WordPress Developer Resources site documents every built-in capability and the full WP_Roles class API, which is the authoritative reference for anything beyond what this guide covers.
The Five Built-In WordPress User Roles Explained
WordPress ships with five default roles. Below is a plain-language breakdown of what each role can do and when to assign it.
| Role | Key Capabilities | Best For |
|---|---|---|
| Administrator | Everything — install plugins, manage users, edit theme files, change settings | Site owner, lead developer |
| Editor | Publish and manage any post or page, moderate comments, manage categories and tags | Managing editor, content lead |
| Author | Publish and manage their own posts only, upload files | Regular contributors who need to publish independently |
| Contributor | Write and edit their own posts, but cannot publish or upload files | Guest writers, new team members under editorial review |
| Subscriber | Read posts, manage their own profile | Members-only content readers, newsletter subscribers |
Administrator
The Administrator role holds every capability WordPress defines — including manage_options, install_plugins, edit_theme_options, delete_users, and activate_plugins. On a single-site install, there is no built-in ceiling on what an Administrator can do. On WordPress Multisite, the Super Admin role sits above Administrator and controls network-wide settings.
Security principle: assign Administrator to as few accounts as possible. One or two people at most. Every additional Administrator account is a potential attack surface.
Editor
Editors can publish, edit, and delete any post or page — including posts written by other users. They can manage categories, tags, links, and moderate comments. They cannot install plugins, change theme settings, or modify site options. This makes Editor the right role for a managing editor on a news or magazine site who needs full content authority without touching infrastructure.
Author
Authors can write, edit, publish, and delete their own posts. They can upload media files to the library. They cannot touch other users’ content. This is the workhorse role for a multi-author blog where contributors publish on their own schedule and the editorial team trusts them to self-edit.
Contributor
Contributors can draft and edit their own posts, but every submission goes through an Editor or Administrator for approval before it publishes. Contributors cannot upload images — a significant limitation for modern posts. One common workaround is to grant Contributors the upload_files capability individually (see the customization section below).
Subscriber
Subscribers can log in, read published content, and edit their own profile. That is essentially all. The Subscriber role becomes powerful when paired with a membership or content-restriction plugin, because you can then conditionally show or hide content based on whether someone is logged in as a Subscriber — and potentially what subscription tier they hold.
Key Capabilities Reference for 2026
WordPress 6.7 defines over 60 primitive capabilities. The ones site owners interact with most often are listed here.
| Capability | What It Controls | Default Role |
|---|---|---|
manage_options |
Settings pages (General, Reading, Permalinks, etc.) | Administrator |
install_plugins |
Installing plugins from the repository or zip upload | Administrator |
activate_plugins |
Activating and deactivating plugins | Administrator |
edit_theme_options |
Customizer, Menus, Widgets | Administrator |
manage_categories |
Creating, editing, deleting categories | Administrator, Editor |
moderate_comments |
Approving, editing, deleting comments | Administrator, Editor |
upload_files |
Uploading to the media library | Administrator, Editor, Author |
publish_posts |
Publishing own posts immediately | Administrator, Editor, Author |
edit_others_posts |
Editing any user’s posts | Administrator, Editor |
delete_others_posts |
Deleting any user’s posts | Administrator, Editor |
read |
Logging in and reading content | All roles |
How to Add or Remove Capabilities in WordPress
There are two routes: code in your theme’s functions.php (or a site-specific plugin), or a dedicated plugin. The plugin route is recommended for most sites because it survives theme changes and provides a visual interface.
Method 1: Code (functions.php or a Custom Plugin)
Use the add_role(), remove_role(), get_role(), WP_Role::add_cap(), and WP_Role::remove_cap() functions. Because role changes write to the database, wrap them in a hook that fires only once — an activation hook on a custom plugin is ideal, or a check using get_option to prevent re-running on every page load.
// Grant Contributors the ability to upload files.
// Place in a plugin activation hook, not directly in functions.php.
function my_site_adjust_caps() {
$contributor = get_role( 'contributor' );
if ( $contributor ) {
$contributor->add_cap( 'upload_files' );
}
}
register_activation_hook( __FILE__, 'my_site_adjust_caps' );
To create a brand-new role:
// Create a custom "Content Manager" role.
add_role(
'content_manager',
'Content Manager',
array(
'read' => true,
'edit_posts' => true,
'edit_others_posts' => true,
'publish_posts' => true,
'manage_categories' => true,
'upload_files' => true,
'moderate_comments' => true,
// Explicitly deny plugin/theme management.
'install_plugins' => false,
'edit_theme_options' => false,
)
);
To remove a capability from an existing role, replace add_cap with remove_cap. To delete a custom role entirely (never delete built-in roles), use remove_role( 'content_manager' ) — typically in a plugin deactivation hook.
Method 2: The Members Plugin
Members by MemberPress (formerly by Justin Tadlock) is the most widely used role and capability manager for WordPress. It adds a visual interface under Users in the WordPress admin where you can create roles, clone existing roles, and toggle individual capabilities with checkboxes. As of 2026 it is actively maintained and compatible with WordPress 6.7.
Key Members features include content restriction by role on individual posts and pages (via a metabox), integration with popular plugins like WooCommerce and bbPress, and an Add-ons library for private site modes and role hierarchies.
Method 3: User Role Editor Plugin
User Role Editor by Vladimir Garagulya is a lighter-weight alternative that focuses on one thing: giving you a grid of every capability and every role so you can check or uncheck permissions. It also lets you assign multiple roles to a single user and grant capabilities per-user rather than per-role. Useful when you need surgical one-off overrides without creating an entirely new role.
Customizing Roles for Three Common Use Cases
Use Case 1: Membership Sites
On a membership site, content access is the core product. The standard Subscriber role is a starting point, but most sites need tiered access — for example, a Free Member who can read introductory posts, a Pro Member who can access premium tutorials, and an Agency Member who can download assets.
The recommended pattern is to create a custom role for each tier (using add_role() or the Members plugin), then use a membership plugin to assign users to the correct role on purchase or registration. Plugins like MemberPress, Paid Memberships Pro, and Restrict Content Pro all integrate with the WordPress role system to automate role assignment on checkout and cancellation.
For content restriction without a full membership plugin, the Members plugin’s content restriction metabox lets you mark individual posts or pages as readable only by specific roles — no extra plugin needed.
Use Case 2: Client Sites
When you hand a site over to a client, the instinct is to make them an Administrator so they can manage everything. Resist this. Administrators can delete plugins, break themes, change permalinks, and lock you out. Instead, create a custom Client role that gives them what they genuinely need day to day:
read,edit_posts,publish_posts,delete_posts— manage their own contentupload_files— add images and documentsmanage_categories— organize contentedit_pages,publish_pages— update service or landing pages
Leave out install_plugins, activate_plugins, edit_theme_options, manage_options, and delete_users. You retain a separate Administrator account for maintenance, and the client gets a clean, safe workspace. This also pairs well with a plugin like AdminimizeWP or White Label CMS to hide the admin menu items the client will never need.
Use Case 3: Multi-Author Blogs
A multi-author blog usually needs a role between Contributor and Editor — someone who can publish their own posts independently (like an Author) but cannot touch other contributors’ work (unlike an Editor). The built-in Author role covers this scenario well, with one common addition: granting manage_categories so authors can create and assign categories without waiting for an admin.
For larger editorial teams, a Senior Editor custom role that mirrors Editor but also has manage_options restricted away works well. You can use the Members plugin to clone the Editor role and then remove the few capabilities you want to restrict.
For an overview of structuring the broader WordPress admin experience for teams, see the WordPress Menus, Widgets, and Sidebars: A Plain-Language Beginners Guide (2026).
Security Best Practices for Limiting Admin Access in 2026
The WordPress role system is only as secure as the discipline with which you manage it. These practices reduce real-world risk without adding unnecessary friction.
1. Maintain the Fewest Administrators Possible
Every active Administrator account that gets compromised gives an attacker full control of the site, including the ability to install arbitrary code. Audit your user list quarterly. Remove former employees, contractors, and agencies as soon as their engagement ends. If someone needs occasional elevated access, grant it temporarily via User Role Editor and remove it afterward.
2. Enable Two-Factor Authentication for Administrators and Editors
Password-only authentication is insufficient for high-privilege accounts. Plugins like Two Factor (maintained by the WordPress.org plugin team) or WP 2FA add TOTP app authentication or email-based one-time codes. Require 2FA for any role that holds edit_others_posts or higher.
3. Never Use “admin” as a Username
Brute-force bots specifically target the username “admin” because it was WordPress’s default for years. Create a new Administrator account with a non-obvious username, then delete or demote the original “admin” account.
4. Audit Roles After Plugin and Theme Installations
Some plugins add custom capabilities to existing roles on activation — occasionally more than you’d expect. WooCommerce, for example, adds capabilities like manage_woocommerce to the Administrator role and creates its own Shop Manager role. Review what a plugin adds before activating it on a production site.
5. Restrict File Editing from the Admin Dashboard
By default, WordPress Administrators can edit theme and plugin files directly from the admin. Disable this by adding the following constant to wp-config.php:
define( 'DISALLOW_FILE_EDIT', true );
This removes the Theme Editor and Plugin Editor menu items entirely, so even a compromised Administrator account cannot inject malicious code through the dashboard. For a deeper look at role-based security auditing, see the post on how to audit WordPress user roles and permissions for better security.
6. Log Role Changes
Unexpected role escalation — a Subscriber suddenly becoming an Editor — is a strong signal of a compromised account or a vulnerability in a plugin. Activity log plugins like WP Activity Log record every role change with a timestamp and the IP address of the session that made the change.
WordPress Multisite: The Super Admin Role
On a WordPress Multisite network, a sixth role exists above all others: Super Admin. Super Admins can manage the entire network, create and delete subsites, install network-activated plugins and themes, and manage users across all sites. Individual site Administrators on a Multisite install have reduced permissions compared to a single-site Administrator — for example, they typically cannot install plugins on their subsite unless the Super Admin enables that capability network-wide.
Super Admin status is granted with grant_super_admin( $user_id ) and revoked with revoke_super_admin( $user_id ). It is not a role in the traditional sense — it is a flag stored separately from the wp_user_roles option. Treat Super Admin accounts with the same care as server root access.
Restricting Content by User Role
Content restriction is the most common reason site owners customize user roles. There are three main approaches, from simplest to most flexible.
Approach 1: Members Plugin Metabox
The Members plugin adds a “Content Permissions” metabox to every post and page. You check which roles can read the content. Users without a qualifying role see either a login prompt or a custom message you define. No custom code required.
Approach 2: Conditional Blocks with a Plugin
Plugins like Visibility Logic for Elementor or Block Visibility (for the block editor) let you apply role-based visibility to individual blocks within a post. This allows hybrid content: a post that’s publicly visible with some sections restricted to logged-in users only. Useful for lead generation pages where you want to tease premium content.
Approach 3: Custom Capability Checks in Code
For developers, the current_user_can() function is the right tool. You can use it in templates, shortcodes, or REST API callbacks to gate any piece of functionality.
// Show a download link only to users with a custom capability.
if ( current_user_can( 'access_premium_downloads' ) ) {
echo 'Download the full report';
} else {
echo 'This content is available to Pro Members. Upgrade your account.
';
}
Pair this with a custom capability you’ve defined on a Pro Member role, and you have a fully programmable content access layer.
Getting Started: Building a New Site With the Right Role Structure
If you are planning a new WordPress site and want to set it up correctly from day one, the role structure is a decision worth making before you start inviting users. Define who needs what access, map those needs to the built-in roles, and identify any gaps that require a custom role or a plugin. For a full walkthrough of launching a WordPress site from scratch, the WordPress Menus, Widgets, and Sidebars guide covers admin orientation for new site owners.
For security-conscious teams, pairing a solid role structure with a maintained WordPress installation is essential. The WordPress.org core team releases security updates regularly — keeping WordPress, plugins, and PHP current is the foundation that role management builds on.
Want a Pro WordPress Site in Minutes?
GigaPress AI builds you a full WordPress site in about 15 minutes — AI handles layout, styling, content, and images. Free to design, only pay when you’re ready to go live. Whether you are setting up a membership site, a client handoff, or a multi-author publication, GigaPress AI gives you a clean WordPress foundation with sensible defaults so you spend time on content and roles, not theme wrangling.
Frequently Asked Questions
What is the difference between a WordPress user role and a capability?
A role is a named label (like Editor or Author) that bundles a set of capabilities together. A capability is a single specific permission (like publish_posts or manage_options). Roles are a convenient shorthand; capabilities are the actual access control mechanism WordPress checks when a user attempts an action.
Can a WordPress user have more than one role?
By default, each user is assigned one role. However, the User Role Editor plugin allows you to assign multiple roles to a single user, with their combined capabilities merged. Some membership plugins also implement this natively to handle tiered access.
How do I stop Contributors from uploading images?
Contributors do not have the upload_files capability by default, so they already cannot upload images to the media library. If you want to grant it selectively, use the Members plugin or User Role Editor to add upload_files to the Contributor role, or add it to individual user accounts via WP_User::add_cap().
What happens to content when I delete a user?
When you delete a user through the WordPress admin, WordPress prompts you to either delete all content attributed to that user or reassign it to another user. Choose reassignment to preserve posts and pages. If you delete the user programmatically with wp_delete_user(), pass a second argument (the reassign user ID) to prevent orphaned content.
Is there a WordPress capability for managing WooCommerce orders without full admin access?
Yes. WooCommerce creates a built-in Shop Manager role that holds manage_woocommerce, view_woocommerce_reports, and capabilities to manage orders, products, and customers — without granting install_plugins, manage_options, or other site-wide admin capabilities. Assign Shop Manager to store staff who need order and inventory access but should not touch site settings.
How do I reset WordPress user roles to their defaults?
Run populate_roles() via WP-CLI (wp eval 'populate_roles();') to restore the default role definitions. This resets the built-in roles to their WordPress defaults but does not affect custom roles you have created. Alternatively, some role manager plugins include a “reset to defaults” button. Always back up your database before resetting roles on a live site.
