Getting To Grips With User Roles & Permissions In WordPress

When building or optimising your website, it’s easy to overlook user roles. And yet, these roles are among the most important pieces in managing your website.

Got more than one person involved with upkeep, content management, or even multiple sub sites? Then understanding and setting limits on who can do what, can go a long way towards minimising mistakes, and maximising security.

Fortunately, WordPress user roles and permissions are both straightforward, and relatively easy to customise. With a good understanding of the basics, you can set up a system in which every user in your organisation plays their part in optimising the website.

That’s why in this post we’ll dig into:

• The standard user roles
• How to customise them
• How they change with WordPress Multisite
• Some tips to help you keep them current and accurate.

The 6 Basic WordPress User Roles

Let’s start with the basics. WordPress allows domain owners to set five basic user roles. These expand to six if you manage a multisite network:

1. Subscribers. They can create and edit accounts on the website but nothing more. This role is designed for WordPress websites that require a log-in for exclusive content. Like an intranet for employees or a customer-only content. It does not help to actually manage the site.
2. Contributors. They can create posts for your WordPress sites. Crucially, though, they cannot publish posts, edit published posts, or delete published posts. We’ve seen this role work well for outsourced content creators, who aren’t a part of the full-time site or content management team.
3. Authors. They can create, publish, and edit posts. Unlike contributors, users with this role can also add files and images to each post. That said, their permissions only extend to the content they create themselves. Not to posts created by other users in the platform.
4. Editors. They can perform everything authors can, but for all posts on the platform. They’re also able to moderate comment sections, and manage tags or categories for all website posts. It’s the perfect role for content managers with a larger strategic view of the content being produced.
5. Administrators. They can modify the entire WordPress site. Create, edit, and dele content, but also edit the website’s them, manage plugins, and perform site updates. They have access to all backbend code, and can assign, manage, and delete all users on the platform.
6. Super Admins. They take the Administrator role on WordPress accounts with Multisite networks. They have Administrator roles for all sites, but can also add and remove sites from the network. Tey can also make changes to code, themes, and plugins that cross all sites. 

Beyond these basic responsibilities, it gets a bit more complex. WordPress has lots of individual responsibilities. All are listed in its Roles and Capabilities article for advanced users to learn and understand.

How To Manage And Customise User Roles In WordPress

When a website is first created, WordPress automatically assigns the Administrator role to the user creating it. From there, you can stick with the standard roles and capabilities, or take some extra steps to customise them.

To customise user rules, you’ll need an external plugin. The most common and popular option is User Role Editor. Which simply adds a new option in the Users menu of the WordPress admin panel to customise each role.

In that setup, you can easily assign each potential capability to a different role. The plugin uses a double-confirmation process to ensure all capabilities are correctly assigned when making any updates.

Using the User Role Editor, you can even create entirely new user types for WordPress management. Within the plugin, simply choose “Add Role” and assign a name to it. From there, you can either start with a copy of an existing role and customise it, or start assigning capabilities from scratch. 

User Role Nuances For WordPress Multisites

In a multisite setup, the Super Admin automatically takes over some of the responsibilities of the Administrator. Now, only a Super Admin can add and modify user roles, edit plugins and themes, and instal updates.

Individual admins can still edit their site on the page level, choose from installed themes, and remove users assigned to their site specifically. But their capabilities will be more restricted otherwise.

Think of it as a strict hierarchy within the user roles: the Super Admin stands at the top, directing Administrators at each site.

Each Administrator has site-level control and oversight of site-level users. But they can no longer make changes that might conflict with the overall plan and strategy for the multisite network.

When it comes to plugins, Super Admins do have the option to provide some autonomy to individual Administrators. In addition to network-activating plugins to be force-installed across the network, Super Admins can also assign each site Administrator the ability to manage the plugins related to their own site.

4 Best Practices To Manage And Maintain Your User Roles

The basics of WordPress user roles are important. Just as important is following a few best practices to ensure that, even as your team grows and changes, these roles remain clear and beneficial to the safety and performance of the website. These 4 tips can help you get started:

Avoid Over-Assigning Responsibilities

Each role, from Subscriber to Super Admin, progressively means more responsibility. We’ve seen WordPress sites work best when each user only has the responsibilities needed to do their job; a content manager likely won’t need administrative privileges. In fact, keeping your higher-level roles at a minimum can close potential security loopholes.

Customise Roles Only When Necessary

By our estimation, about 95% of organisations will not need custom user roles. Customisation just because it’s an available option can become complex quickly, decreasing efficiency and safety. We recommend sticking with your standard roles first, and only thinking about customisation when the standard roles clearly won’t suffice.

Document Your Role Assignments and Layout

Documentation can help you keep things straight when your team increases in complexity. Keep a simple sheet in which you outline each role, who is assigned, and what their responsibilities are. This becomes especially important for larger teams and multisite networks. Where a wide range of team members and external professionals might contribute.

Review and Adjust Your Roles Regularly

A regular review, every three to six months, can ensure that your roles remain strictly within your plan and in the best interest of your website and organisation. It also allows you to remove or adjust user roles when responsibilities have changed, removing potential security loopholes.

Summary

Properly managing user roles in WordPress is one of those things that isn’t an issue until it becomes one. Understanding the basics, and managing it early, can go a long way towards avoiding future confusion or security issues. 

Of course, this is just one of the many WordPress best practices that website owners can benefit from.

If you’re looking for WordPress training to better equip your team for day to day management of your website, we offer training workshops tailored to the needs of your business.