What Do WordPress's Different User Roles Actually Allow?
The Core Roles, in Order
Each role bundles a specific, predefined set of capabilities (like edit_posts or manage_options), and WordPress checks these capabilities, not the role name itself, whenever deciding whether a user can perform a specific action — the role is really just a convenient, named shortcut for a particular capability set.
What Each Role Can Actually Do
- Subscriber — can log in and manage their own profile, but has no content-editing capability at all; mainly relevant for a site requiring login for some other purpose (comments, a members area).
- Contributor — can write and edit their own posts, but cannot publish them directly; an editor or administrator needs to review and publish on their behalf.
- Author — can write, edit, and publish their own posts independently, but cannot edit or manage other users' content.
- Editor — can write, edit, and publish any post or page on the site, including other users' content, but cannot install plugins, change themes, or manage site-wide settings.
- Administrator — full control over everything, including plugins, themes, users, and all settings; this level of access should be granted carefully and sparingly.
Choosing the Right Role for Someone
- Assign the minimum role that covers what someone actually needs to do, rather than defaulting to Administrator for convenience.
- Use Editor for trusted content managers who don't need site-configuration access.
- Consider a custom role with a specific capability set if none of the default roles fits a particular staff member's actual needs precisely.
- Periodically review who has Administrator access and remove it from anyone who no longer genuinely needs it.
Need custom roles or a permissions audit for your team? See WordPress bug fix.