Can I let staff edit only some of our website?
Not page by page in core WordPress. Roles decide what kinds of content someone can edit: an Author edits only their own posts, an Editor edits everything. Beaver Builder can stop a role from moving or deleting layout. For one person on one page, use a well-chosen plugin, or have them send changes for someone else to publish.
The short version
- Core WordPress roles work by type of content, not by page.
- Contributor: writes posts but can’t publish. Good for staff who draft news.
- Author: publishes and edits only their own posts.
- Editor: edits every page and post. Give it only to people you’d trust with all of them.
- Beaver Builder can let a role change words in existing modules without moving or deleting anything.
What can each role do?
From WordPress’s roles page:
| Role | Can do |
|---|---|
| Contributor | Write and manage their own posts, but not publish them |
| Author | Publish and manage their own posts |
| Editor | Publish and manage all posts and pages, including other people’s |
| Administrator | Everything, including plugins, themes, settings and users |
Authors and Contributors work in Posts, not Pages. So a staff member who writes news is easy. A staff member who should update only the events page is not, because pages need an Editor.
Our answer on which role to give staff explains the roles in more detail, and our help article on adding or removing editor access shows the clicks.
What are the safe ways to limit someone?
1. Contributor plus a reviewer
The staff member writes a post as a Contributor and selects Submit for Review. An Editor or Administrator checks it and publishes. Nothing goes live without a second pair of eyes. This suits blog posts, news and event write-ups.
2. Beaver Builder user access
If your site uses Beaver Builder, an Administrator can go to Settings, then Beaver Builder, then User Access. The user access guide lists options by role, including Builder Access and Unrestricted Editing.
A role with builder access but without unrestricted editing can only change content in existing modules. It can’t move or delete items, use saved items or open row and column settings. That’s a good fit for staff who update words and photos but shouldn’t change the layout. It doesn’t limit which pages they can open.
3. A dedicated plugin
Some plugins let you assign people to specific pages or sections. They add code and settings to maintain, and a mistake can give more access, not less. Ask whoever maintains the site to choose, test and document one.
4. Send changes instead
For staff who change things once a month, it’s often simplest for them to email the change to one person who publishes it. No login to manage, and no login to lose.
Why does it matter?
Every login is a door. The fewer people with Editor or Administrator access, the fewer chances for a stolen password or an honest mistake to affect the whole site. Our cybersecurity hub covers the wider rule in managing vendor and contractor access.
What are the common mistakes and edge cases?
- Making everyone an Administrator because a plugin screen was missing. Fix the plugin’s permission instead.
- Sharing one login so several people can edit. You lose the record of who did what, and you can’t remove one person. See sharing access safely.
- Forgetting leavers. Remove their user on their last day, and pass their posts to someone else when WordPress asks.
- Plugin roles. Store, calendar and form plugins add their own roles, such as a shop manager. Read what they allow before assigning one.
- Synced content. A staff member editing a page can change a synced pattern that appears everywhere. See reusable content.
What if this didn’t work?
- If a staff member can’t see a page they need, check their role first.
- If they can see too much, lower their role. You can always raise it again.
- If a plugin screen is missing for an Editor, that plugin may need Administrator access. Ask whoever maintains the site rather than promoting the person.
How long does it take?
Changing a role takes a minute. Setting up Beaver Builder user access takes a few minutes and a test with a staff login. A page-level plugin is a small project.
How does E-3 handle this?
Logins on sites we look after through website care belong to the client’s business, and E-3 is added as one more user. Clients can also send their changes to us instead of logging in: a person at E-3 makes the change, and bigger changes are tested on a staging copy first.
Related questions
Next step
- Next: How do WordPress releases and updates work?The next guide in WordPress for owners.
- Website careUptime monitoring, tested updates, daily backups and security alerts.
Still stuck? Ask E-3 for an answer from our help guides.
Rather we handled wordpress for owners for you?
It’s part of what we do every week for small businesses, as part of website care. Start with a free check of your site and profile, or call and ask.