How to manage WordPress user roles

For a website to run smoothly and without com­plic­a­tions, each user must un­der­stand their re­spect­ive tasks and admin rights. With WordPress, user roles are easy to set up and maintain. We’ll show you how to manage WordPress roles, which roles exist, and what you should consider when setting them up.

WordPress roles define user rights and access per­mis­sions for a website. The number of tasks on a website can be huge, but beyond posting content not every single employee may be au­thor­ised to make changes to the page’s settings, for example. User roles can range from creating new posts to adding other users to in­stalling a plugin. It’s usually a good idea to ensure everyone un­der­stands their re­spect­ive tasks and thereby prevent in­ad­miss­ible behaviour right from the start.

Say you’re de­vel­op­ing a website for a client. You’ll want them to be able to access their content, but not ne­ces­sar­ily have per­mis­sion to modify a theme. WordPress roles work in a similar way. An editor does not need to and should not be able to access plugins; however, employees in charge of adding visual content or modifying posts will require the ap­pro­pri­ate access. A well thought-out and stringent division of WordPress role per­mis­sions, rights and clearly com­mu­nic­ated duties ensure smooth pro­cessing and more effective and safe working.

Some five or six different roles can be defined in WordPress. It is important to dis­trib­ute tasks sensibly from the get-go and issue per­mis­sions ac­cord­ingly.

Every website has an ad­min­is­trat­or by default. This person has all per­mis­sions, access to all cap­ab­il­it­ies, and gets to assign WordPress role per­mis­sions. The admin adds or deletes new users, installs updates or plugins, changes themes, and has control over the entire site. The ad­min­is­trat­or role should be assigned to a user well-suited to this kind of re­spons­ib­il­ity; someone who is trust­worthy and reliable and able to maintain a good overview of all op­er­a­tions. It is also re­com­men­ded that only one person act as an ad­min­is­trat­or and access is protected by means of a .htaccess password.

Editors are re­spons­ible for pub­lic­a­tions on the site. A WordPress editor can create, change, publish, and delete posts and pages. This also applies to posts and pages created by other users. So the main task of an editor is to oversee the content across the website and supervise other users. On the other hand, editors cannot install plugins, themes, or updates

Unlike the two previous WordPress user roles, the author is solely re­spons­ible for their content. Therefore, they can neither correct, nor publish or delete posts of other users. But an author can post, edit, and remove their own con­tri­bu­tions and upload media such as images and videos. Authors can assign their posts to existing cat­egor­ies, but they cannot create their own cat­egor­ies.

The con­trib­ut­or is sub­or­din­ate to the editor. Although they can write and create their own con­tri­bu­tions, they must be published by an editor (or the ad­min­is­trat­or). Con­trib­ut­ors have neither the option to change or delete their con­tri­bu­tions af­ter­wards, nor can they access the con­tri­bu­tions of other users. This is ideal for external con­trib­ut­ors or guest authors who con­trib­ute content, but cannot or should not take re­spons­ib­il­ity for the site.

Sub­scribers have no active cap­ab­il­it­ies or rights on WordPress Place­hold­er: WordPress E-Book for Beginners. They can only modify and customise their personal profile. However, they have access to all posts on the site and are allowed to read them. This model is suitable for users who should have access to exclusive content on the site. However, there is no col­lab­or­a­tion on the content.

This WordPress user role exists only in multisite systems. The Super Ad­min­is­trat­or has all rights and access to all websites of the network and is superior to admins of the in­di­vidu­al sites. Only they can install themes, manage plugins, and even delete in­di­vidu­al pages.

While the above WordPress roles are standard, some plugins let you set up other roles with ad­di­tion­al clearly defined tasks and cap­ab­il­it­ies. Examples include manager functions for stores or SEO editors.

WordPress user roles are defined and assigned per­mis­sions in the backend.

1. First, click on ‘Users’ in the menu on the left and select ‘Add New’.
2. In the user ad­min­is­tra­tion you can see which entries are required and which are voluntary.
3. The username is the first entry. This is not the user’s real name. For security reasons, the username should not hint at what the first or last name of the new user could be.
4. Enter their email address to share login data with the new user. Each address can only be used once.
5. Adding a first name and surname is optional. Leaving them blank means that posts will be published under the username. However, actual names tend to look more pro­fes­sion­al here.
6. Adding a website is optional. The re­spect­ive user may wish to link to their personal website.
7. Passwords are auto-generated when you create new roles in WordPress. However, the first time a user logs in, they will be prompted to create a new password. To best protect your website and data, users should choose a secure password. To be ab­so­lutely sure, it is re­com­men­ded to use a password tool for this purpose.
8. Finally, you can choose from the different WordPress user roles and assign a position and thus ap­pro­pri­ate per­mis­sions to the new user.

Admins can manage names, dates, passwords, or WordPress roles or change in­di­vidu­al entries in the web ad­min­is­tra­tion panel. To do this, simply click on ‘Users’ on the left side and then ‘All Users’. Select the ‘Edit’ option under the user you wish to edit or change per­mis­sions for.

Main­tain­ing, keeping track of, and managing in­di­vidu­al WordPress user roles can be confusing and time-consuming, es­pe­cially among large teams with numerous editors and authors. For this purpose, various WordPress plugins are available to customise roles and access rights and maintain an overview of per­mis­sions.

If a user no longer works for you or your website, you can simply delete them from the backend. This way you can maintain the order and ensure that the former employee no longer has access to the content of your site. To do this, click on ‘Users’ in left sidebar and then on ‘All Users’. Place a checkmark beside the user you wish to delete and click ‘delete’ from the dropdown menu at the top left under ‘Select action’.

Since you may wish to preserve content that the user has created, WordPress now gives you the option to assign posts to another user. Al­tern­at­ively, you can delete all content of the user and click on ‘Confirm deletion’.