Understanding User Roles in WordPress

What Are User Roles?

WordPress uses a role-based system to control what each person can do on your website.

Every person who logs in is given a role, and that role decides what they can see and change. Giving people the right role keeps your site secure and prevents accidental changes to important settings.

The Five Standard Roles

WordPress comes with five built-in roles, each giving a different level of access — from the most access to the least:

• Administrator — full control of the entire website: settings, plugins, themes, users, and every page and post. Example: InnerMedia usually holds this role — it’s the only one that should touch plugins, updates or user accounts.
• Editor — can create, edit, publish and delete any page or post (including other people’s), and manage media, categories and comments — but can’t change site settings, plugins or users. Example: a content or marketing lead who looks after all the site’s content.
• Author — can create, edit and publish their own posts and upload media, but can’t touch pages or anyone else’s content. Example: a regular blog contributor who publishes their own news posts.
• Contributor — can write and edit their own posts but can’t publish them (they go to an Editor or Administrator for review), and can’t upload images. Example: an occasional guest writer whose work is checked before it goes live.
• Subscriber — can manage their own profile and read content only; they can’t create or edit anything. Example: a member or customer who logs in to view members-only content.

As a rule, give each person the lowest role that still lets them do their job. It keeps your site secure and limits the risk of accidental changes.