How to manage user roles and permissions in WordPress

Start with the smallest built-in role that fits the job. Subscribers can manage their profiles, Contributors can write posts but not publish them, Authors can publish their own posts, Editors can manage other users’ content, and Administrators manage nearly all settings on a single-site installation. Multisite adds the Super Admin role for network-level tasks.

Do not assign Administrator simply because someone needs to publish posts. Extra capabilities can expose plugins, themes, settings, users, and site data.

Go to Users > All Users, select a user, choose the required role in the role selector, and save the change. For a new account, go to Users > Add New and choose the role before creating the user.

To control the role given to future accounts, go to Settings > General and change the default user role. This changes the default for new users, not existing accounts.

A role is a group of capabilities, while a capability is a specific permission such as edit_posts, publish_posts, upload_files, or edit_others_posts. If a user needs one exception, add or remove that capability rather than making them an Administrator.

For a custom role, WordPress provides add_role(). To change an existing role, retrieve it with get_role() and use the role’s add_cap() or remove_cap() method. Put role-creation code in a plugin activation hook or another controlled one-time condition; running it on every request is an easy way to create confusing maintenance problems.

Create a test user with the same role and try the real job: create a post, edit someone else’s post, upload media, submit content for review, manage comments, or edit a page. Check both the dashboard and the front end.

A role can appear correct while a plugin or theme blocks a screen. Editors normally have capabilities for other users’ posts and pages, so if that stops working, investigate changed capabilities or a plugin conflict before granting broader access.

Pay particular attention to permissions that affect the whole site, including plugin and theme management, user management, unfiltered HTML, and Site Editor access. The edit_theme_options capability can provide Site Editor access but may also expose other theme-related administration, so grant it only when the job requires it.

Remove unused accounts, review administrator access regularly, and document any custom role. Keep a recovery administrator account available before changing permissions on a live site.

For a few users and standard publishing tasks, the built-in role selector is the fastest route and is usually enough. If you need fine-grained controls for custom post types, WooCommerce, content restrictions, or multisite access, use a role-management plugin instead of maintaining custom code.

PublishPress Capabilities Pro is a suitable option when you need an interface for creating and modifying roles, controlling detailed capabilities, and managing permissions across more complex WordPress sites. Apply changes gradually, then retest each important workflow.