WordPress User Roles & Permissions Explained

The 6 Default Roles

A user role is a bundle of capabilities: the individual permissions that decide who can publish, who can edit other people's work and who can install plugins. WordPress pre-assigns six of these roles, and the table is the whole system at a glance:

Roles live under Users in wp-admin and carry over any WordPress hosting plan; editing workflows pair with them. What each role contains, and who should hold which, sits below.

Capabilities in Detail

A capability is one specific permission: publish_posts lets a user hit the Publish button, moderate_comments opens comment moderation, edit_users reaches the account list. A role is the bundle — WordPress pre-assigns each default role its capability set, and the permissions stack, so an Editor can do everything an Author can plus more.

Who Gets What: Writers, Clients, Agencies

Match the role to the work, then stop. A freelance writer who files finished, publish-ready posts gets Author; one whose copy needs review first gets Contributor. The person running the editorial calendar — a content lead or marketer — takes Editor, with publish rights over everyone's work.

Administrator belongs to the site owner and, by default, nobody else. When an agency builds the site, it works as admin during the build and hands the admin account back with documentation at handover, keeping only the access it still needs. Clients who only update content take Editor, never Administrator: one compromised admin login exposes plugin installs, files and every setting. That least-privilege habit is the cheapest control on the list, and it pairs with the WordPress security services checks.

Capabilities go beyond content too. Administrators hold the dangerous ones — installing plugins, editing theme files, updating core — which is why that role is rationed. Plugins add their own: WooCommerce ships two extra roles, Customer and Shop Manager, and membership plugins register theirs, so check a plugin's documentation for what it introduces.

Creating Custom Roles With Plugins

When the defaults do not fit — say a designer who may edit templates but never publish — a role-editor plugin such as Members or User Role Editor builds a custom bundle, or code registers one with add_role() and tunes it with add_cap() and remove_cap().

Be sparing. Capabilities overlap more than they look: edit_theme_options opens the Site Editor plus other theme screens, so a "template editor only" role is easy to get wrong. Test any new role with a throwaway account before handing it out, and delete custom roles nobody uses any more.

Multisite Super Admin Explained

The Super Admin exists only on multisite networks, where one WordPress install hosts many sites. It manages the network itself: creating and deleting sites, installing plugins and themes for the whole network, and managing users across it.

On a standard single-site install there is no Super Admin — the Administrator already holds every capability, including the network-reserved ones. On multisite the split is real: single-site Administrators lose install-level powers such as updating plugins or editing users network-wide to the Super Admin. If you are not running multisite, ignore the role entirely.