WordPress roles should give each person the capabilities required for their work and no more. Administrator access can install code, change configuration and manage users, so it should be treated as privileged business access rather than the default role for every supplier or employee.
Understand roles and capabilities
WordPress uses capabilities—individual permissions—grouped into roles. The standard single-site roles are Administrator, Editor, Author, Contributor and Subscriber. Plugins can add capabilities or custom roles, and Multisite introduces the Super Admin role with network-wide powers.
Assign by task
| Task | Likely starting role | Check before assigning |
|---|---|---|
| Publish and manage all editorial content | Editor | Custom post types, forms and plugin-added permissions |
| Publish own posts | Author | Media access and editorial workflow |
| Write for approval | Contributor | Image-upload and preview requirements |
| Customer/member account | Subscriber or application-specific role | Account pages and personal-data exposure |
| Maintain software/configuration | Administrator or delegated host access | Can a narrower temporary route perform the work? |
| Manage a Multisite network | Super Admin | Network-wide theme, plugin and user consequences |
Use named individual accounts
Do not share one administrator login. Named accounts create accountability, make revocation possible and allow stronger authentication. Keep at least one business-controlled emergency administrator whose recovery email and MFA are not owned by an outside supplier.
Review plugin-added permissions
Commerce, membership, SEO and form plugins may add roles or give administrators access to sensitive records. Test what each role can actually see and change. A role label such as “shop manager” does not by itself prove that access matches the organisation’s policy.
Manage temporary supplier access
- Define the work and minimum required access.
- Create a named account with an expiry/review date.
- Use delegated hosting or vendor access rather than sharing the owner account where possible.
- Require secure credential transfer and MFA where supported.
- Review logs and changes after the work.
- Revoke access and rotate shared secrets at handover.
Audit regularly
- Former staff, agencies and freelancers
- Duplicate or dormant administrator accounts
- Unexpected role changes or new users
- Application passwords, API keys and integration accounts
- Recovery email addresses and MFA devices
- Custom roles left by removed plugins
Avoid editing capabilities blindly
Capability plugins can be useful, but changing built-in or custom roles may expose configuration or break workflows. Back up first, document the reason, test with a non-administrator account and retain a separate recovery administrator.
Role acceptance test
Create test accounts for each operational role and attempt the real tasks: drafting, publishing, uploading, viewing submissions, refunding an order and changing settings. Check both what the user can do and what sensitive information they can see.
Repeat the test after major plugin changes. Plugins may add capabilities to existing roles or create new roles, changing access without an obvious warning in the user list.
Practical next step
Export or review the current user list, name the owner of every privileged account and remove or downgrade any account that cannot be justified today.
Sources and date checked
This guide was checked on 21 July 2026. WordPress, plugins, hosting platforms and commercial terms change, so confirm the current documentation and licence details before making a material change.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.