{"id":18993,"date":"2026-10-22T21:02:17","date_gmt":"2026-10-22T18:02:17","guid":{"rendered":"https:\/\/www.hyyat.com\/knowledgebase\/wordpress-user-roles\/"},"modified":"2026-10-22T21:02:31","modified_gmt":"2026-10-22T18:02:31","password":"","slug":"wordpress-user-roles","status":"publish","type":"docs","link":"https:\/\/www.hyyat.com\/en\/knowledgebase\/wordpress-user-roles\/","title":{"rendered":"WordPress User Roles and Permissions: Who Needs Administrator Access and Who Does Not"},"content":{"rendered":"
\n
In short<\/b>WordPress has five core roles: the Administrator controls everything, the Editor manages all content, the Author publishes their own posts, the Contributor writes without publishing, and the Subscriber only reads and manages their profile. The golden rule: give each person the lowest role that does the job. Every extra administrator account is another door that can be opened.<\/div>\n
\"WordPress<\/figure>\n

Many sites have five or six Administrator accounts: the owner, the designer who built the site two years ago, the content writer, a former employee. If any of these passwords is stolen, the attacker can install a malicious plugin or delete the whole site. The fix is not complicated: each person gets only the role their work needs.<\/p>\n

The five roles and what each can do<\/h2>\n
\n\n\n\n\n\n\n\n\n\n
Role<\/th>\nWhat it can do<\/th>\nSuitable for<\/th>\n<\/tr>\n<\/thead>\n
Administrator<\/td>\nEverything: plugins, themes, users, settings and content.<\/td>\nThe owner and one trusted technical person.<\/td>\n<\/tr>\n
Editor<\/td>\nPublish, edit and delete all posts and pages, including others\u2019, and manage comments.<\/td>\nThe content manager or chief editor.<\/td>\n<\/tr>\n
Author<\/td>\nWrite, publish and edit their own posts, and upload images.<\/td>\nA trusted regular writer.<\/td>\n<\/tr>\n
Contributor<\/td>\nWrite posts without publishing; they wait for an editor\u2019s approval.<\/td>\nA guest writer or trainee.<\/td>\n<\/tr>\n
Subscriber<\/td>\nRead content and manage their own profile only.<\/td>\nRegistered site members.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n

In a WooCommerce store<\/h3>\n

WooCommerce adds two roles: Shop Manager handles products, orders and reports without touching plugins or files, and Customer is for people who buy. A support or sales employee only needs Shop Manager. Read WooCommerce security<\/a>.<\/p>\n

How to tidy your site\u2019s permissions step by step<\/h2>\n
    \n
  1. Open the users list:<\/b> In the WordPress dashboard choose Users, then filter by role.<\/li>\n
  2. Review every Administrator:<\/b> Ask: does this person really need to install plugins and change settings? If they only write content, lower them to Editor or Author.<\/li>\n
  3. Delete old accounts:<\/b> The designer who finished, the employee who left. When deleting, WordPress asks who should own their content; pick an existing account.<\/li>\n
  4. Never share one account between people:<\/b> Each person gets their own, so you know who did what. Read the WordPress activity log<\/a>.<\/li>\n
  5. Make temporary access truly temporary:<\/b> If a developer needs Administrator rights to fix something, create an account and delete or downgrade it when done.<\/li>\n
  6. Close open registration if you do not need it:<\/b> In Settings, General, make sure the new user default role is Subscriber, and untick \u201cAnyone can register\u201d if your site does not need it.<\/li>\n<\/ol>\n
    Important:<\/b> if you find an Administrator account you do not recognise, do not just delete it. It may be a sign of a hack. Read the signs your website is hacked<\/a> and scan your files.<\/div>\n

    How many Administrators does a site need?<\/h2>\n

    For most sites, one or two: the owner and one technical person. Everyone else works with lower roles. And if you have an Administrator named admin, read protecting the WordPress login page<\/a>.<\/p>\n

    \n

    How Hyyat Host protects your site<\/h2>\n