Many sites have five or six Administrator accounts: the owner, the designer who built the site two years ago, the content writer, a former employee. If any of these passwords is stolen, the attacker can install a malicious plugin or delete the whole site. The fix is not complicated: each person gets only the role their work needs.
The five roles and what each can do #
| Role | What it can do | Suitable for |
|---|---|---|
| Administrator | Everything: plugins, themes, users, settings and content. | The owner and one trusted technical person. |
| Editor | Publish, edit and delete all posts and pages, including others’, and manage comments. | The content manager or chief editor. |
| Author | Write, publish and edit their own posts, and upload images. | A trusted regular writer. |
| Contributor | Write posts without publishing; they wait for an editor’s approval. | A guest writer or trainee. |
| Subscriber | Read content and manage their own profile only. | Registered site members. |
In a WooCommerce store #
WooCommerce adds two roles: Shop Manager handles products, orders and reports without touching plugins or files, and Customer is for people who buy. A support or sales employee only needs Shop Manager. Read WooCommerce security.
How to tidy your site’s permissions step by step #
- Open the users list: In the WordPress dashboard choose Users, then filter by role.
- Review every Administrator: Ask: does this person really need to install plugins and change settings? If they only write content, lower them to Editor or Author.
- Delete old accounts: The designer who finished, the employee who left. When deleting, WordPress asks who should own their content; pick an existing account.
- Never share one account between people: Each person gets their own, so you know who did what. Read the WordPress activity log.
- Make temporary access truly temporary: If a developer needs Administrator rights to fix something, create an account and delete or downgrade it when done.
- Close open registration if you do not need it: In Settings, General, make sure the new user default role is Subscriber, and untick “Anyone can register” if your site does not need it.
How many Administrators does a site need? #
For most sites, one or two: the owner and one technical person. Everyone else works with lower roles. And if you have an Administrator named admin, read protecting the WordPress login page.
How Hyyat Host protects your site #
- Brute force protection blocks addresses that repeat failed logins on WordPress accounts. Read brute force protection.
- ImunifyAV scans files daily and catches malicious plugins that a stolen Administrator account might upload.
- WP Toolkit in cPanel lets you manage and update WordPress sites from one place.
Learn more about Hyyat Host WordPress hosting.
Frequently asked questions #
What is the difference between Editor and Author?
An Author manages only their own posts. An Editor manages all posts and pages, including others’, and moderates comments.
Can an Editor install a plugin?
No. Installing plugins and themes and changing settings are Administrator rights only.
Can I create a custom role?
Yes, with a role management plugin. But the core roles suit most sites, and every customisation needs careful review.
