A Guide to WordPress User Roles and Permissions

WordPress is by far the most popular blogging and web creation tool available. Third-party apps and documentation for the platform are enormous. With each new update, WordPress coders continue to keep core features up to date while exploring new CMS horizons. At the heart of WordPress are user roles and permissions.

The system defines each person’s position within the platform. From Super Admin to Subscriber, every individual who logs in has a specific set of permissions or capabilities that are assigned by the Super Admin or Administrator. A capability is a specific function or a set of actions that a user is permitted to complete. Each role is clearly defined, so there are no misunderstandings about security. A WordPress security plugin from the directory can help with these fundamental tasks.

Get the bonus content: A Guide to WordPress Security

Agencies, Freelance Web Developers, and Small Business Owners need to give a lot of thought into how the organization can best utilize WordPress user roles — taking the time to plan the organization before installation saves a lot of headaches later on.

A Few Tips Before Installation

Author, Contributor, and Subscriber roles are straight forward in their creation and permissions. The Super Admin, Administrator, and Editor positions can be a major area of strength for the organization if carefully considered and plotted out.

• Multi-site installations should have one Super Admin, regardless of the number of additional sites. If there is any security, user, or core file issue, Super Admins are responsible. Security should be on the mind of every person involved with a website. WordPress is exceptional in the way it updates core files and security; however, having multiple Super Admins can cause havoc
• Designate a single Administrator or Editor for each additional site in a multisite network. If there are hundreds of virtual sites, give Administrators or Editors more than one site to manage
• Freelance web developers selling sites or Agencies should give Administrator duties to each site owner, but strictly forbid access to any network setting

A breakdown of the default WordPress user roles.

Super Admin

• There is always confusion for new WordPress users when faced with this designation. This misunderstanding is settled with this statement, “A Super Admin has complete access to every administrative function within a WordPress Multisite installation. The role of Super Admin exists only in a multisite network. The Super Admin role does not exist in a single WordPress site”

Multisite networks using WordPress is one of the most advanced and productive features of the platform. What is a WordPress Multisite; Install WordPress on a server “once” and designate that installation as a multisite. You then have the opportunity to run as many virtual sites as you want.

A Super Admin can create new websites, manage themes and plugins across the multisite network, add, manage, or delete content on every site. The Super Admin controls the network with all settings and security issues. The first user setting up the multisite network is the default Super Admin.

If an additional Super Admin is needed, granting a user the role is quite simple 1) Locate the user by email or name search 2) Click the “EDIT” link under the person’s name 3) Select “Grant this user super admin privileges for the Network.”

Super Admin Tips:

1. Keep the organization simple. A single user with just a couple of sites only needs the default Super Admin. As the organization grows, then create meaningful user roles for employees.
2. There are many ways to configure a multisite network and its users. If you are an agency or freelancer with multiple sites, assign each client or principle the Administrator or Editor role for a specific site.
3. Concentrate on security from the first login. WordPress is a favorite target for experienced hackers, and sophistication is growing in the world of malware and virus attacks. Browser fingerprinting is also a rising threat to privacy.
4. Control network-wide settings with caution. Plan the new user registrations and welcome emails with care.
5. Use default content and language for new sites to promote the original WordPress installation.

Administrator

In a single WordPress installation, the Administrator user role has full access to every feature within the site. Administrators can make changes to core installation files. The updating process is an area that needs to be approached with caution; a single mistake can take down the site.

The Administrator user role has the responsibility of adding or modifying users and their permissions which is another function to handle with care. As an example, Administrators can allow users to post their content in HTML or JavaScript. Un-trusted users can cause havoc on hosting and the WordPress installation. Again, an excellent WordPress security plugin can be invaluable in these situations.

When managing the security of the site, the first step for an Administrator is to create a unique password for the role, something that has not been used in the past. Security begins and ends with the Administrator role.

Just as there should be a limited number of Super Admins in a multisite installation, the same advice holds true with a single site installation. Web designers or agencies can assign all the permissions every user needs without allowing them access to core files. Small business owners should have only one Administrator account.

In a multisite installation, the Administrator role has complete access to their single site and no more.

Administrator Capabilities:

1. Site-Wide: update WordPress core files, manage all settings, manage HTML and JavaScript code for all users
2. Plugins: install, edit, and delete
3. Themes: install and switch, edit widgets and menus, access the customizer
4. Users: create, edit, and remove
5. Posts and Pages: add new, publish, manage taxonomies

Administrator Tips:

• Limit the number of users given Administrator permissions. Ideally, there should only be one user who controls the WordPress installation
• Require each user to submit a unique password, approved by the Administrator. Without this precaution, it is an easy entryway for hackers
• Learn HTML and JavaScript, at the very least, gain a solid understanding of the languages. WordPress is remarkable when users can customize the site, independent of themes and plugins
• Keep the core WordPress files updated and secure. Use a WordPress security plugin and a password manager to control access

Get the bonus content: iThemes Security Setup Guide

Editor

The Editor within WordPress is a unique user role. Only the Administrator has more capabilities. An Editor has no access to site settings, themes, plugins, or users. The Editor role is designed to manage all the content on the site, including other user’s content.

Editors are not website managers; however, their permissions go well beyond adding or deleting their content. Editors can manage categories on the site along with adding or deleting custom tags. Taxonomies and uploading files to the site is another responsibility of the Editor role.

Who Should Be An Editor?

• Small business owners can wear both hats, the Administrator and Editor
• Manager of a Content team
• Manager of an online publication
• Marketing managers responsible for content

The Editor’s role should go to someone Administrator’s trust. Roles can be tweaked throughout WordPress; if needed, permissions of the Editor role can be reduced or changed as trust is gained.

Comments are another area Editors have full control of. They can moderate, approve, or delete any comment. Users feel they belong to something or someone bigger than themselves with a robust commenting system. On the other side of the coin, an unregulated comment section can be a nightmare with easy access by hackers.

Editor vs. Author

New users may see WordPress Editors and Authors in the same light. In many ways, they are however, there are differences.

• Pages: Editors have access to all pages with permission to add, edit, or delete. Authors have no such access
• Content: Editors have access to all content on the site. In a multisite network, only the permissions given the Editor role. Editors can delete or edit all content. Authors have access to edit or delete, only the content they have produced

Author User Role

The first non-management role in a WordPress installation is that of an Author. Purists believe it is the only true role of any importance. WordPress began as a simple blogging system way back in 2003. The platform now powers 32% of the known web. The world’s favorite CMS “was born out of a desire for an elegant, well-architected personal publishing system.” In many ways, WordPress remains a personal blogging tool, even though it is capable of so much more.

Authors have a limited set of permissions within a WordPress installation. The role can add, edit, or delete their content, but have no access to other content, or site settings. Author roles can be as extensive or limited as the Editor or Administrator allows. The authors have permission to upload content and images.

Security should be a fundamental building block for any WordPress site. Any role which can upload or access content should require “special attention.” New CMS users are not attuned to the far-reaching devious abilities of modern malware and website viruses. Passwords and permissive security measures have brought down millions of websites before they have a chance to grow. A solid WordPress security plugin and other third-party software is a necessity.

Who Should Be An Author?

• Organizations that have dedicated content creation or marketing teams such as reporters, public relations, company spokespeople
• Any company that distributes information such as a news channel, or sports companies should give reporters the Author role. Additional permissions can be given on an as-needed basis

A note of caution

• Be cautious giving the user role of Author to someone who is NOT in your employ or untrustworthy. If they have created a lot of content and then leave the company, the Author can delete every bit of content
• It is advisable, when someone leaves the website, change the password and lock them out of the site IMMEDIATELY! It is always a best practice to delete ANY Author user role leaving the site and reassign the content to another Author. If a user is leaving with plans to return, change the password immediately and take away any granted permissions. Reinstate the role when the user returns

Contributor

The Contributor user role has very few permissions in a WordPress installation. The default permission is the ability to submit content for review. Contributors cannot publish the content or upload any associated images. Only an Editor or an Administrator can publish the content. Once the content is published, a Contributor no longer has access to that content.

Contributors submit their content to either an Administrator or Editor for review. Here is an overview of the post submit and approval process:

1. Contributors write their content in the WordPress Editor and when completed, hit the “Submit for Review” button
2. Editors or an Administrator logs into WordPress and locates the post from pending approvals
3. The post is edited for any grammatical errors and images should be inserted at this stage. The Admin or Editor then hits the “Publish” button.
4. Any future edits or changes need to be done by the Administrator or Editor because the original Contributor no longer has access to the post.

Who Should Be A Contributor?

• Writer’s outside the organization who can contribute to the blog
• Entry-level content writers that need heavy editing should be contributors

Contributor vs. Author

• Publishing content: Authors have the permissions to publish and edit their content and no other. Contributors can only submit their posts for review. Once a Contributor’s content is published, only the Administrator or Editor can edit the piece
• Media and images: Contributors have no access to images or media. Authors can upload and edit their media

Subscriber

The Subscriber user role has the least amount of permissions in WordPress. The default two permissions for a Subscriber; they can view their profile and view the dashboard. Subscribers have no permissions to edit content or any WordPress site settings.

Subscribers can be used as an inclusionary or entry-level access tool for marketing purposes. By default, Subscribers have no access to any site settings or content, making the role inherently safe. As a marketing tool, the Subscriber role is a perfect entry point to your site. It is the most restrictive role; however, it gives the person a profile, which is all a person needs to feel included. There are a lot of plugins that can expand on the basic Profile.

Who Should Be A Subscriber?

• A prerequisite for posting comments or posts on the site
• Entry-level, subscriber-only content
• Collect permission-based email addresses and other personal data

To recap: The top three management user roles in a WordPress installation have areas of the site specifically designed for that position. Super Admins and Administrators control the dashboard and core files, and the site itself. While Editors control the content manager and other content. Authors and Contributors control only their content and no other. Subscribers can access only the content and permissions given to the role by the management positions.

Keep reading the article at WordPress News and Updates from iThemes – iThemes. The article was originally written by Kristen Wright on 2020-02-21 12:54:37.

The article was hand-picked and curated for you by the Editorial Team of WP Archives.