How to manage WordPress user roles

What this problem looks like

WordPress ships with Administrator, Editor, Author, Contributor, and Subscriber roles. Plugins add roles such as Shop Manager or SEO Manager.

Capabilities map to actions like activate_plugins or edit_theme_options. Role editor plugins change that map and can lock you out if misconfigured.

Step 1: Default WordPress roles explained

Administrator: full site control including plugins and users.
Editor: publish and edit all posts, no plugin install.
Author: publish own posts only.
Contributor: write posts but cannot publish.
Subscriber: profile access only, typical for memberships.

Step 2: Change a user role in wp-admin

Users → All Users.
Click the username.
Change Role dropdown.
Update User.

Step 3: Manage roles with WP-CLI on SSH

Only run these commands if you have SSH access to the server.

bash

wp user list --fields=ID,user_login,roles
wp user set-role jane editor
wp role create client_editor --clone=editor

Step 4: WooCommerce Shop Manager

Shop Manager can manage orders, products, and coupons without installing plugins. Use it for fulfilment staff.

Step 5: Custom roles and security

User Role Editor and Members add capabilities. Export role settings before experiments.

Remove old agency accounts when contracts end. Forgotten admin users are breach targets.

When to stop DIY and hire help

Complex membership and multisite role maps need careful planning. BugShield configures WordPress access at a confirmed fixed price without handing clients dangerous defaults.

Questions answered

WordPress user role FAQs

Answers about least privilege, default roles, WooCommerce access, custom capabilities, account reviews, and recovering administrator access.

How many administrators should a site have?

As few as practical, often one or two owners. Use lower roles for everyone else.

Can Editor install plugins?

No. activate_plugins is Administrator-level unless a role editor changed it.

What is Super Admin on multisite?

Network Super Admin controls all sites. Site Administrators on individual subsites have narrower scope.

Will deleting a user delete their content?

WordPress asks whether to reassign content to another user or delete it. Reassign for staff turnover.

Which WordPress role should I give a new user?

Choose the lowest role that supports their job. Avoid Administrator unless the person must manage plugins, themes, users, and site-wide settings.

What should the default new-user role be in WordPress?

Subscriber is the safest normal default for public registration. Never use Administrator, Editor, or Shop Manager as an automatic public role.

What is the difference between Shop Manager and Administrator?

Shop Managers can manage much of WooCommerce without full control of plugins, themes, and users. Administrators control the entire WordPress site.

Can I create a custom WordPress role?

Yes. Add only the required capabilities through a maintained role tool or tested code, and document why the custom role exists.

How often should I audit WordPress users and roles?

Review them regularly and whenever staff, agencies, or developers change. Remove unused accounts, unexpected administrators, and access that is no longer needed.

How do I recover if no WordPress administrator remains?

Use WP-CLI or carefully restore the correct capabilities in the database through secure hosting access, then review how the role was lost.

Keep troubleshooting

Learn how to manage WordPress user roles.