WordPress user roles explained

Understand the five standard WordPress user roles — Administrator, Editor, Author, Contributor, and Subscriber — and know which role to assign to each person on your team.

Every person who logs in to your WordPress site is assigned a role — a set of permissions that controls what they can see and do. Assigning the right role to each person protects your site from accidental (or intentional) damage.

Quick summary

A standard WordPress site has five built-in roles (a multisite network adds a sixth, Super Admin). Administrator can do everything. Editor manages all content. Author manages their own posts. Contributor writes but can't publish. Subscriber can only manage their own profile. Assign the least powerful role that lets the person do their job. Never give Administrator access to people who don't need it.

The five WordPress roles at a glance

Role	Can publish?	Can manage others' content?	Can change settings?	Can add users?
Administrator	Yes	Yes	Yes	Yes
Editor	Yes	Yes	No	No
Author	Yes (own posts)	No	No	No
Contributor	No (submits for review)	No	No	No
Subscriber	No	No	No	No

Each step outwards adds power the role before it does not have. That is why the safe choice is the least powerful role that still lets the person do their job.

Read this as text

WordPress has five built-in roles, and they are not five separate lists of permissions. They run in order of power, from Subscriber up to Administrator, and each one is a step up from the one before it. Subscriber is the smallest: a Subscriber can log in and update their own profile, but cannot create or edit any content.

A Contributor can write and edit their own draft posts but cannot publish — their work goes into Pending Review for an Editor or Administrator to approve. An Author can write, edit, publish, and delete their own posts, but cannot edit other people’s content and cannot create or edit pages. An Editor can create, edit, publish, and delete any post or page, including content created by other users, but cannot change site settings, install plugins, or manage users. An Administrator can do everything: install and delete plugins, change the theme, manage all users, access all settings, and edit any content.

Because the roles run in order of power, picking one is mechanical: start at the least powerful and stop at the first role that covers what the person actually needs. Subscriber suits a member of a members-only section, Contributor a guest blogger or intern, Author a team member or contractor who writes blog posts, Editor a content manager or marketing team member — and Administrator only the primary business owner and the Chykalophia team.

These are the roles WordPress builds in. Some plugins add custom roles of their own alongside them — WooCommerce, for example, adds a Shop Manager role for store management.

Role-by-role breakdown

Administrator

The most powerful role. Administrators can do everything — install and delete plugins, change the theme, manage all users, access all settings, and edit any content.

Give this role to: The primary business owner, and the Chykalophia team when we need full access to work on your site. No one else.

Protect Administrator access carefully

If an Administrator account is compromised, an attacker has full control of your site. Use a strong, unique password and turn on two-factor authentication for Administrator accounts (WordPress needs a plugin for this). See WordPress security basics.

Editor

Editors can create, edit, publish, and delete any post or page — including content created by other users. They cannot change site settings, install plugins, or manage users.

Give this role to: A content manager, marketing team member, or anyone who needs to manage the blog and update pages but shouldn't touch settings.

Author

Authors can write, edit, publish, and delete their own posts only. They cannot edit other people's content, and they cannot create or edit pages (only posts).

Give this role to: A team member or contractor who writes blog posts but doesn't manage the wider site.

Contributor

Contributors can write and edit their own draft posts, but they cannot publish — their work goes into the "Pending" (pending review) status for an Editor or Administrator to approve and publish.

Give this role to: A guest blogger, intern, or anyone who contributes content but whose work should be reviewed before it goes live.

Subscriber

Subscribers can log in to your site and update their own profile, but they cannot create or edit any content. This role is mainly used for membership sites or gated-content sites where registered users get special access.

Give this role to: Registered members of a members-only section, or customers who need to access a private resource. Most public-facing websites don't need Subscriber accounts.

Which role should you assign?

A good rule of thumb: give the least powerful role that still lets the person do their job.

Ask yourself:

Do they need to change settings or install plugins? → Administrator (rare)
Do they need to manage other people's content and all pages? → Editor
Do they only write their own blog posts? → Author or Contributor
Do they need to access member-only content? → Subscriber

Giving Chykalophia access

When you invite us to work on your site, give our account Administrator access — we need it to do most technical work.

Use the email address support@chykalophia.com, unless your project lead has given you a different address. See how to add a new user for step-by-step instructions.

When the project is complete, you can downgrade or remove our access. See how to remove a user safely.

Roles and plugins

Some plugins — WooCommerce, LearnDash, bbPress, and others — add custom roles on top of WordPress's defaults. For example, WooCommerce adds "Shop Manager" and "Customer" roles, and LearnDash adds a "Group Leader" role. These custom roles usually appear alongside the standard five in the user management screen.

See WooCommerce store access if you need to give access to your store specifically.

Common questions

I accidentally made someone an Administrator. How do I fix it?

Go to Users → All Users in your dashboard, find the person, click "Edit," change their Role dropdown to the correct role, and click "Update User." The change is immediate.

Can I create custom roles with specific permissions?

Yes, but it requires a plugin (like "User Role Editor") or custom code. WordPress's default five roles cover most needs. If you need something specific — for example, a role that can edit pages but not posts — ask us and we can set it up.

What happens if the only Administrator account is deleted?

WordPress guards against this: it won't let you delete the account you're logged in with, or change your own role to one that can't manage users. If it did happen some other way, nobody on the site could change settings, plugins, themes or users. This is why you should always have at least two Administrator accounts — one for you, and one for us. Never delete the last Administrator. See how to remove a user safely.

I'm an Editor but I can't access certain settings. Is that normal?

Yes. Editors are deliberately limited to content management and cannot access settings, plugins, themes, or users. If you need to do something that requires Administrator access, ask the site Administrator to do it, or to give you a higher role for a while.

Does the user role affect what someone can see in the WordPress app?

Yes. Your site enforces your role, so the WordPress mobile app can't do anything your role doesn't allow in the dashboard.

Need a hand?

If you're stuck, email support@chykalophia.com and we'll help. Include your website address and a screenshot if you can.

Learn more

WordPress user roles documentation

WordPress user roles explained

On this page