OK. After all these boring things let's see ...
The user roles and capabilities in Wordpress
Wordpress offers you five different roles that can be assigned to individual users and obviously, each role comes with well-defined capabilities and limitations. Let's take a closer look at each one ...
1. Subscriber
The lowest level. By default, any visitor can subscribe to your site, but the capabilities of this role are extremely limited. In fact, they can do one and only one thing: to manage their own profile.
If you want, you can use this role to limit who gets to leave comments on your site. How? It's simple ... All you need to do is to require users to register as a subscriber, and then log in any time when they want to leave a comment ...
2. Contributor
As you can guess, they have the capability of contributing content to your site, by writing posts.
More precisely, they can create, edit and delete their own unpublished content pieces. But that's it! Nothing else ...
Of course, they can access the back-end area in order to create content, but they can't publish their own masterpieces, because their post editor doesn't have a "Publish" button at all. All they have is "Submit For Review" button.
Finally, they can't upload media items, they can't add featured images and they don't have the capability to edit or alter an already published article.
3. Author
Basically, the authors are "upgraded" contributors. They have the capability to upload media, to publish their own posts and to edit or delete their own published posts.
4. Editor
He's your "super-user". He has all the previously mentioned capabilities and in addition he can:
- create, edit and delete pages or private pages
- publish, edit or delete posts from other users
- manage categories
- moderate comments
5. Administrator
That's you. The boss. Capo di tutti capi. The only user who has full control over the entire website, who can add, edit or delete users and to change user roles.
Awesome training (as always) - thank you very much! ;-)
Zed, I've read somewhere (not on WA), that one should preferably publish your blogposts under a user with the bare minimum rights (ie user "Sharlee" with only Contributor rights) and then "approve" my posts through the back-end.
Their thinking was that in the event one's account/password get guessed, they can only get into the limited "contributor" profile.
Your thoughts on this, Zed? Is there any substance to their reasoning?
Looking forward to hearing from you! ;-)
Sharlee (Chocolate IceCream)