OK. After all these boring things let's see ...

The user roles and capabilities in Wordpress

Wordpress offers you five different roles that can be assigned to individual users and obviously, each role comes with well-defined capabilities and limitations. Let's take a closer look at each one ...

1. Subscriber

The lowest level. By default, any visitor can subscribe to your site, but the capabilities of this role are extremely limited. In fact, they can do one and only one thing: to manage their own profile.

If you want, you can use this role to limit who gets to leave comments on your site. How? It's simple ... All you need to do is to require users to register as a subscriber, and then log in any time when they want to leave a comment ...

2. Contributor

As you can guess, they have the capability of contributing content to your site, by writing posts.

More precisely, they can create, edit and delete their own unpublished content pieces. But that's it! Nothing else ...

Of course, they can access the back-end area in order to create content, but they can't publish their own masterpieces, because their post editor doesn't have a "Publish" button at all. All they have is "Submit For Review" button.

Finally, they can't upload media items, they can't add featured images and they don't have the capability to edit or alter an already published article.

3. Author

Basically, the authors are "upgraded" contributors. They have the capability to upload media, to publish their own posts and to edit or delete their own published posts.

4. Editor

He's your "super-user". He has all the previously mentioned capabilities and in addition he can:

  • create, edit and delete pages or private pages
  • publish, edit or delete posts from other users
  • manage categories
  • moderate comments

5. Administrator

That's you. The boss. Capo di tutti capi. The only user who has full control over the entire website, who can add, edit or delete users and to change user roles.



Join the Discussion
Write something…
Recent messages
TeamIceCream Premium
Hi Zed

Awesome training (as always) - thank you very much! ;-)

Zed, I've read somewhere (not on WA), that one should preferably publish your blogposts under a user with the bare minimum rights (ie user "Sharlee" with only Contributor rights) and then "approve" my posts through the back-end.

Their thinking was that in the event one's account/password get guessed, they can only get into the limited "contributor" profile.

Your thoughts on this, Zed? Is there any substance to their reasoning?

Looking forward to hearing from you! ;-)
Sharlee (Chocolate IceCream)
Reply
smartketeer Premium
Nonsense Sharlee.

If they guessed you password they have access to the admin area, so they can create a new admin user ...
Reply
TeamIceCream Premium
Thanks for clearing that Zed!

Is there anything regarding to user rights, that we can do to make our WP websites safer? Or less vulnerable? (Whichever way one wants to look at it.) :-)
Reply
TeamIceCream Premium
Awesome, thank you Zed! ;-) I'm sending your favorite e-IceCream your way! (Just add a bit of imagination, okay?) ;-) LOL!
Reply
smartketeer Premium
Thanks :))
Reply
dowj01 Premium
Thank you for the information.
Justin
Reply
smartketeer Premium
Thanks for your time Justin!
Reply
bushrash Premium
Very informative, thanks for sharing with us.

Best Wishes,
Bushra
Reply
smartketeer Premium
Thanks for your time Bushra!
Reply
lesabre Premium
Thanks for sharing Zed
Reply
smartketeer Premium
Thanks for reading.
Reply
Top