What WordPress user role should I give my staff?
Give each person the lowest WordPress role that lets them do their job. Staff who update pages usually need Editor; people who only write their own posts need Author or Contributor. Keep Administrator to the owner and the company that runs the site. Everyone gets their own login, and leavers are removed the same day.
The short version
- Give each person the least access that lets them do their job.
- Editors manage all pages and posts; Authors and Contributors handle their own posts.
- Keep Administrators to a very short list.
- One login per person, with two-factor sign-in for anyone powerful.
- Remove leavers the same day and review the user list every few months.
What do the WordPress roles do?
On a normal single WordPress site, there are five standard roles. WordPress’s roles and capabilities page describes them:
| Role | What it can do | Good fit for |
|---|---|---|
| Administrator | Everything: plugins, themes, users, settings | Owner and your web company |
| Editor | Publish and manage all posts and pages, including other people’s | Office manager who updates the site |
| Author | Publish and manage their own posts, and upload files | Staff who write news or blog posts |
| Contributor | Write and manage their own posts, but not publish them | Someone whose posts need review |
| Subscriber | Manage their own profile only | Members or customers |
Multisite networks add a Super Admin, and plugins can add roles. WooCommerce, for example, adds Shop Manager, which suits staff handling orders better than Administrator.
Why does the role matter?
The idea is “least privilege.” If an Editor’s password is stolen, the damage stays within the content. If an Administrator’s is stolen, the attacker can install anything, add users and lock you out. Unknown administrators are a classic sign of a hacked site.
How do I set roles up well?
- One login per person. Never share accounts.
- Two-step sign-in for administrators at least. See two-factor authentication.
- Strong, unique passwords in a password manager. See managing business passwords.
- Remove leavers the same day, and reassign their content to another user rather than deleting it.
- Review the user list every few months and question any account you don’t recognize.
For the steps to add or remove someone, see how to add or remove a person’s access.
What are the common mistakes and edge cases?
- Making everyone an Administrator because it’s easier.
- Plugins changing roles. Some membership, course or shop plugins add roles or give existing ones extra powers. After installing one, check what each role can now do.
- Unnamed agency logins. Your web company may need its own administrator account. That’s normal, but it should be a named account you can see and remove if you change providers.
What if someone has the wrong access already?
An Administrator can change a person’s role from the Users screen at any time. If you find an account nobody recognizes, don’t just delete it: change your passwords and get the site checked, because it may mean someone got in.
How long does it take?
Reviewing roles on a small site takes about as long as reading the user list. Fixing them takes minutes per person.
How does E-3 handle this?
On sites in E-3’s website care, a person at E-3 can add or remove a user, or change a role, when you ask. Website care also includes security alerts.
Related questions
Common questions
- How many administrators should my site have?
- As few as possible: usually the owner and the company that looks after the site. Each extra administrator is one more account that can change everything if its password is stolen.
- Can staff share one login?
- Avoid it. You can't remove one person from a shared login, you can't see who changed what, and the password ends up written down everywhere.
- What should I do with a leaver's posts?
- When you delete their user, WordPress lets you assign their content to another user. Do that instead of deleting their pages and posts.
Rather talk it through?
Call our team, or send a note and we’ll reply within one business day. No pressure and no jargon.