Manage WordPress users and roles

  • users
  • roles
  • admin
  • security

Every WordPress user has a role that decides what they can change. Give each person the most limited role that still lets them do their job. Accounts live under Users.

Add a user

  1. Go to Users → Add New User.
  2. Enter a Username (you can't change it later) and Email.
  3. Set a strong password, or keep the one WordPress generates.
  4. Choose whether to email the new user their login details.
  5. Pick a Role, then click Add New User.

Which role to choose

Role What they can do
Administrator Everything: plugins, Customizer, other users. Only site owners and your web team.
Editor Edit and publish any page or post, including other people's. Good for an in-house content lead.
Author Write and publish their own posts. Can't edit pages or other people's posts.
Contributor Write drafts. Can't publish.
Subscriber Log in only. No editing.

When WooCommerce is active, you'll also see Shop Manager and Customer. A Shop Manager can manage orders and products, so treat it like a store admin rather than a page editor.

WordPress has no built-in "Manager" role. Any other roles you see were added by a plugin, so check what they allow before assigning them.

Edit a user or reset a password

  1. Go to Users and click the username.
  2. Change the name, email, or Role.
  3. If they're locked out, use Set New Password or send a password reset link.
  4. Click Update User.

Remove a user

  1. On Users, hover over the account and click Delete.
  2. Choose whether to delete their content or give it to another user.
  3. Confirm.

Never delete the site's only Administrator.

Remove accounts as soon as someone leaves. Unused logins are an easy way in for attackers. Before you hand over a new login, test the role in a private window to confirm it can reach what they need.