WordPress User Roles Explained: Who Should Have Administrator Access?

Introduction

One of the easiest ways to create unnecessary risk on a WordPress website is to give every user Administrator access.

It is understandable why businesses do it.

An Administrator can access almost everything, so giving someone that role avoids questions about why they cannot see a menu, install a plugin or change a setting.

But convenience is not always the best approach.

WordPress has a built-in system of user roles and capabilities specifically designed to control what different people can do.

For businesses investing in website design Stirling, understanding these roles can help protect the website from accidental changes, compromised accounts and users having access to areas they do not actually need.

The principle is simple: each person should generally have the lowest level of access that still allows them to do their job properly.

What Are WordPress User Roles?

A WordPress user role is a collection of permissions assigned to a user.

WordPress refers to these individual permissions as capabilities.

Capabilities control actions such as:

• editing posts
• publishing pages
• uploading media
• moderating comments
• installing plugins
• changing themes
• managing users
• changing website settings

Instead of deciding each permission individually for every user, WordPress groups common capabilities into predefined roles.

WordPress provides official documentation explaining the role and capability system here: WordPress Roles and Capabilities.

What Are the Default WordPress Roles?

A normal WordPress website includes five main user roles:

• Administrator
• Editor
• Author
• Contributor
• Subscriber

WordPress Multisite installations also include a higher-level role called Super Admin.

Each role has a different collection of capabilities.

The roles should not necessarily be thought of as job titles.

They are better understood as different permission sets.

What Can a WordPress Administrator Do?

Administrator is the most powerful role on a normal single-site WordPress installation.

An Administrator can perform tasks such as:

• installing and activating plugins
• updating plugins and themes
• changing website settings
• editing themes
• managing users
• publishing and editing pages
• publishing and editing posts
• uploading files
• changing menus and site options

Depending on the plugins installed, Administrators may also have access to:

• WooCommerce settings
• payment gateway configuration
• SEO settings
• backup systems
• security plugins
• forms
• analytics integrations
• API credentials

This makes Administrator access extremely powerful.

It also means an Administrator account can cause significant damage if it is compromised or used incorrectly.

Who Should Have Administrator Access?

Administrator access should normally be limited to people who genuinely need control over the technical or administrative operation of the website.

This may include:

• the business owner
• the website provider
• a trusted internal website manager
• a senior technical employee

The exact number depends on the organisation.

There is no requirement that only one Administrator exist.

The important question is whether each person actually needs that level of access.

Not Every Staff Member Needs Administrator Access

A staff member who only updates page content does not usually need to install plugins.

A marketing assistant who publishes articles does not usually need to change payment gateway settings.

A contractor uploading images does not usually need permission to create new Administrator accounts.

Giving all of these users Administrator access creates unnecessary exposure.

For businesses using web development Stirling, careful permission design should form part of the ongoing management of the site rather than being considered only after something goes wrong.

What Can a WordPress Editor Do?

The Editor role is often suitable for someone responsible for managing website content.

Editors can generally:

• create posts
• edit posts
• publish posts
• edit other users’ posts
• manage pages
• publish pages
• moderate comments
• upload media

They do not normally have access to high-level technical administration such as installing plugins or changing core website settings.

This makes Editor a useful role for many marketing, communications and content-management staff.

Editor Access Is Often Enough for Day-to-Day Content Work

A common mistake is assuming someone needs Administrator access simply because they need to update several parts of the website.

In many cases, Editor access is sufficient.

An Editor can manage a substantial amount of content without having access to technical areas that could affect the whole website.

This creates a useful separation between:

• content management
• technical administration

That separation can reduce the chance of accidental plugin changes, deleted settings or other site-wide problems.

What Can a WordPress Author Do?

The Author role is more restricted.

An Author can generally:

• write their own posts
• publish their own posts
• edit their own posts
• delete their own posts
• upload media

They cannot normally edit posts created by other users.

This role can be useful for websites with several writers who each manage their own articles.

When Is the Author Role Useful?

Author access may suit:

• regular blog contributors
• staff members responsible for their own news articles
• subject-matter experts writing under their own name

It provides enough access to publish content without giving the user control over the rest of the website.

On a business website with several content contributors, this can help keep responsibilities clear.

What Can a WordPress Contributor Do?

A Contributor can create and edit their own posts but cannot publish them.

This means another user with suitable permissions must review and publish the content.

Contributor access can be useful when the business wants an editorial approval process.

For example:

• a junior staff member drafts an article
• a subject expert reviews it
• an Editor publishes it

This can provide an additional layer of content control.

What Can a Subscriber Do?

Subscriber is the most limited standard WordPress role.

A Subscriber can generally log in and manage their own profile.

This role is commonly relevant to websites where users need accounts but do not need editorial or administrative access.

Depending on the website, plugins may extend Subscriber capabilities for:

• membership areas
• online courses
• customer portals
• restricted content

The base WordPress role itself remains very limited.

What Is a WordPress Super Admin?

Super Admin is a special role used in WordPress Multisite.

A WordPress Multisite network can contain multiple websites managed from one WordPress installation.

The Super Admin can manage network-wide functions such as:

• sites
• network users
• plugins
• themes
• network settings

This role does not normally appear on a standard single WordPress website.

Roles and Capabilities Are Not the Same Thing

A role is a named group of capabilities.

A capability is the actual permission.

Examples of WordPress capabilities include:

• edit_posts
• publish_posts
• manage_options
• activate_plugins
• edit_users
• upload_files

This distinction matters because WordPress can be customised beyond its default roles.

A developer can create a custom role containing a specific set of capabilities for a particular business requirement.

Custom Roles Can Be Better Than Giving Someone Administrator Access

Sometimes the default Editor role is too restrictive while Administrator access is too broad.

That is where custom roles can be useful.

For example, a business might create a role that allows someone to:

• edit all website content
• manage WooCommerce products
• view orders
• manage forms

while preventing them from:

• installing plugins
• changing themes
• creating Administrators
• changing critical security settings

This provides access based on the person’s actual responsibilities.

Plugins Often Add Their Own Roles and Capabilities

WordPress plugins can add new roles or capabilities.

WooCommerce, membership systems, learning platforms and other plugins may introduce permissions that do not exist in a standard WordPress installation.

For example, ecommerce sites may provide roles designed for shop management or customers.

This means website owners should not assume that every WordPress site has exactly the same permission structure.

The installed plugins and custom development can significantly change what users are allowed to do.

Why Too Many Administrators Can Increase Risk

Every Administrator account represents another credential capable of making major website changes.

If an Administrator account is compromised, an attacker may potentially be able to:

• install malicious plugins
• create new users
• change website settings
• alter content
• access sensitive plugin areas
• disable security tools

Reducing unnecessary Administrator accounts therefore reduces the number of highly privileged accounts that need to be protected.

The Principle of Least Privilege

A widely used security principle is to give users only the access required to perform their responsibilities.

This is often called the principle of least privilege.

On a WordPress website, that could mean:

• a content writer receives Author access
• a marketing manager receives Editor access
• a technical website manager receives Administrator access

The point is not to make people’s jobs difficult.

The aim is to avoid giving powerful permissions where they provide no practical benefit.

Separate User Accounts Are Better Than Shared Logins

Businesses sometimes create one Administrator account and share the username and password between several staff members.

This creates several problems.

If everyone uses the same account:

• you cannot easily identify who made a change
• the password may be shared insecurely
• removing access for one person becomes harder
• password changes affect everyone

Each person should normally have their own account.

This makes access easier to manage and improves accountability.

Do Not Use Generic Administrator Usernames Where Possible

Usernames such as:

• admin
• administrator
• website

are predictable.

A predictable username alone does not make a site insecure, but there is little advantage in making half of the login credentials easy to guess.

Use individual accounts with appropriate usernames and strong passwords.

Strong Passwords Still Matter

User roles reduce what an account can do, but they do not make compromised passwords harmless.

Every website user should use an appropriate password, particularly users with elevated permissions.

Administrator accounts deserve particular attention because of the amount of control they have.

Passwords should not be:

• shared between websites
• easy to guess
• sent around casually in email or messaging systems
• reused after a known compromise

Multi-Factor Authentication Adds Another Layer

Where practical, multi-factor authentication can add additional protection to important WordPress accounts.

This normally requires something beyond the password when signing in.

Depending on the system, this may involve:

• an authenticator app
• a security key
• a passkey
• another approved authentication mechanism

This can significantly reduce the usefulness of a stolen password on its own.

Remove Access When Someone Leaves the Business

Former staff accounts are easy to forget.

If someone leaves the organisation or no longer needs website access, their account should be reviewed promptly.

Depending on the circumstances, you may:

• delete the account
• disable access through a security system
• reduce the user’s role
• transfer their content to another user

Do not leave old Administrator accounts active simply because they are no longer being used.

Review Contractor and Agency Access

External contractors may legitimately need access during a project.

Examples include:

• web developers
• SEO consultants
• marketing agencies
• plugin developers
• technical support providers

When the engagement ends, review whether the account still needs to exist.

If ongoing access is required, make sure the role still reflects the work being performed.

Temporary Administrator Access Should Actually Be Temporary

A support provider may occasionally need Administrator access to investigate a problem.

There is nothing inherently wrong with granting temporary elevated access where it is genuinely required.

The problem occurs when temporary accounts remain active for years.

After the work is complete, review and remove unnecessary access.

Website Providers May Need Permanent Administrator Access

For a fully managed website, the situation can be different.

A website provider responsible for:

• updates
• security
• backups
• technical support
• plugin management
• troubleshooting

may reasonably require ongoing Administrator access.

The key distinction is that the access serves an active technical responsibility.

This is different from leaving an old contractor account active with no ongoing purpose.

Be Careful When Changing Administrator Roles

Do not downgrade every Administrator account without understanding what it is used for.

Some accounts may belong to:

• website management systems
• developers
• automated integrations
• support providers

Changing a role without checking first can interrupt legitimate workflows.

Review accounts individually.

Plugins Can Change What an Editor Can Do

The standard WordPress role descriptions are useful starting points, but real websites can behave differently.

Plugins may add new capabilities or make features available only to certain roles.

For example, an Editor may be able to modify normal pages but not:

• form settings
• SEO plugin configuration
• WooCommerce settings
• special custom content

This does not necessarily mean the user should immediately become an Administrator.

A custom role or specific capability may be the better solution.

WooCommerce Websites Need Extra Care

An ecommerce site often contains information and settings that go beyond ordinary website content.

Depending on the role and plugin configuration, users may have access to:

• customer details
• orders
• refunds
• products
• shipping settings
• payment settings

Access should therefore be based on the person’s actual responsibilities.

A staff member who manages product descriptions may not need access to payment gateway settings.

Online Course and Membership Sites Can Have Many User Types

Learning platforms and membership websites often create additional roles for:

• students
• members
• instructors
• group leaders
• customers

These roles should remain separate from administrative website access.

A person having an account on the website does not mean they need access to the WordPress administration area.

Do Not Make Customers Administrators

This may sound obvious, but poorly configured websites can occasionally assign inappropriate default roles to new users.

WordPress includes a setting controlling the default role assigned to newly registered users.

That setting should be checked carefully on sites allowing public registration.

The default role should never be Administrator.

WordPress allows the default role to be selected under the site’s general settings. You can read the official user documentation here: Users Add New screen.

Review the User List Periodically

A simple user audit can identify old or inappropriate access.

Review:

• who has Administrator access
• whether former employees still have accounts
• whether contractors still need access
• whether unfamiliar accounts exist
• whether roles match current responsibilities

The WordPress Users screen allows authorised users to search accounts, change roles and remove users.

Periodic reviews can prevent old permissions from quietly accumulating over several years.

Unknown Administrator Accounts Need Investigation

If you find an Administrator account that nobody recognises, do not simply assume it belongs to an old developer.

Investigate it.

An unexpected Administrator account can sometimes indicate that a website has been compromised.

Other signs worth checking may include:

• unfamiliar plugins
• unexpected file changes
• spam content
• redirects
• unknown scheduled tasks

Our article Website Security for Small Businesses: What Your Website Provider Should Be Looking After covers the broader security picture.

Deleting a User Does Not Have to Delete Their Content

When removing a WordPress user who has created content, WordPress can generally reassign that content to another user.

This is important when removing:

• former employees
• old authors
• contractors

Review the content ownership options carefully rather than deleting an account without considering what it created.

Back Up Before Major Permission Changes

Changing one user’s role is normally straightforward.

More extensive permission changes deserve greater care.

If you are:

• creating custom roles
• removing capabilities
• changing plugin-defined permissions
• altering many users at once

take an appropriate backup first.

Our guide Website Backups: What Should Be Backed Up and How Often? explains why reliable backups matter before significant website changes.

Custom Roles Should Be Documented

If a developer creates custom WordPress roles, the business should know what they are for.

For example:

• Website Editor
• Store Manager
• Content Manager
• Marketing Editor

Document:

• who should receive the role
• what the role can do
• what it deliberately cannot do

This makes future access decisions much easier.

Do Not Modify WordPress Permissions Without Understanding the Consequences

Capabilities can be powerful.

Removing the wrong permission may stop a user from performing necessary work.

Adding the wrong permission may expose technical settings or sensitive information.

Custom role changes should therefore be tested carefully.

For complex websites, it may be appropriate to test permission changes in a staging environment before applying them to the live site.

Administrator Access Is Not a Status Symbol

Administrator should not be viewed as the senior or important account.

It is simply a role with broad technical capabilities.

A company director who only needs to review content may require less access than the staff member responsible for managing the website.

The role should reflect the task, not the person’s position in the organisation.

Less Access Can Make WordPress Easier to Use

Restricting permissions is not only about security.

It can also simplify the WordPress dashboard.

A user responsible only for content does not necessarily benefit from seeing menus for:

• plugins
• themes
• tools
• technical settings
• security configuration

A more focused dashboard can make content management less confusing.

User Permissions Should Be Part of Website Onboarding

When a new employee or contractor needs website access, the onboarding process should answer:

• What work will they perform?
• Which areas do they need to access?
• How long will they need access?
• What role is appropriate?

This is much better than automatically creating another Administrator account.

User Permissions Should Also Be Part of Offboarding

Website access should be included whenever someone leaves the organisation.

Offboarding may involve removing access to:

• WordPress
• hosting
• Cloudflare
• domain management
• analytics
• email marketing
• other connected services

The WordPress account is only one piece of the wider digital access picture.

Do Not Forget Hosting and Cloudflare Access

Removing someone’s WordPress Administrator role does not remove access they may have elsewhere.

A former technical provider could potentially retain access to:

• hosting control panels
• DNS
• Cloudflare
• database systems
• FTP or SFTP
• Git repositories

Website access reviews should therefore consider the whole infrastructure.

Administrator Access Should Not Be Used for Everyday Browsing

Where practical, highly privileged accounts should be used intentionally rather than as the default account for every routine activity.

On larger websites, a person who performs both technical administration and content publishing may even use different accounts for different responsibilities.

This is not essential for every small business, but it illustrates the broader principle of limiting unnecessary privileged activity.

Audit Logs Can Improve Accountability

On websites with multiple administrators or editors, activity logging can help identify important changes.

Depending on the tools used, logs may show actions such as:

• user creation
• plugin activation
• settings changes
• content edits
• login activity

This can be valuable when investigating an unexpected website change.

Logging should be implemented sensibly and with appropriate consideration for privacy and storage.

WordPress Roles Are Only One Security Layer

Good user permissions cannot compensate for an otherwise poorly maintained website.

A secure WordPress environment also needs:

• current WordPress software
• current plugins and themes
• reliable backups
• strong authentication
• secure hosting
• malware monitoring
• appropriate firewall protection

User access should be considered alongside these other controls.

What Role Should You Give a Website User?

A practical starting point is:

• Administrator for trusted people who genuinely manage technical website settings
• Editor for people responsible for broad content management
• Author for people publishing their own articles
• Contributor for people writing content that needs approval
• Subscriber for basic registered accounts where no editorial access is needed

Plugins or custom roles may provide more suitable options on complex websites.

Ask What the User Needs to Do, Not What They Might Need One Day

The safest approach is to begin with the person’s actual responsibilities.

Ask:

• Do they need to publish content?
• Do they need to edit other people’s content?
• Do they need access to orders?
• Do they need to install plugins?
• Do they need to create users?
• Do they need to change technical settings?

Assign the role based on those answers.

If responsibilities change later, access can be reviewed.

Good Access Control Protects the Business as Well as the Website

WordPress user roles may look like a small technical detail, but they affect:

• security
• accountability
• privacy
• content quality
• website stability

Giving every user Administrator access is rarely necessary.

WordPress provides a flexible permission system specifically so businesses can give people the access they need without giving them control over everything.

For businesses looking for web design Stirling, website design Stirling or web development Stirling support, user access should be considered part of ongoing website management rather than an afterthought.

PrimeSites Digital helps businesses manage WordPress websites, user permissions, security, backups, hosting, Cloudflare and ongoing technical maintenance.

If you are unsure who currently has access to your website or whether everyone has the right permissions, get in touch with PrimeSites Digital or book a free chat.