WordPress user roles and permissions determine what each person can do on your site. For a business, the goal is not to give everyone access to everything. It is to provide the minimum access needed for a person’s assigned work, then review that access when the work or relationship changes.
That approach helps limit the impact of mistakes or compromised accounts. The Federal Trade Commission advises businesses to limit administrator access and give staff only the access they need. You can read its guidance on controlling access to sensitive data.
Start with the task, not the title
Job titles alone are not a reliable guide to WordPress access. Two people with the same title may have different responsibilities, while a contractor may need a narrowly defined capability for a specific project. Write down the tasks each person performs, then choose a role that fits those tasks.
WordPress’s built-in roles are useful starting points, but they are not a perfect match for every site. Plugins, themes, custom roles, and multisite configurations can change what a user is able to do. Check the capabilities on your own site rather than assuming a role behaves identically everywhere.
What the standard WordPress roles generally allow
- Subscriber: Typically limited to managing their own profile. This may fit someone who needs to sign in but does not create or manage site content.
- Contributor: Can write and manage their own drafts, but generally cannot publish them. This can suit a writer whose work needs editorial review.
- Author: Can publish and manage their own posts. Consider whether publishing without review is part of the person’s responsibility before assigning this role.
- Editor: Can manage and publish content, including content created by other users. Editor is not a low-risk role simply because it is not Administrator. It can give someone broad control over the site’s content.
- Administrator: Has broad control over site administration. Depending on the setup, this can include managing users, settings, themes, and plugins. Reserve it for people who genuinely need administrative capabilities.
These descriptions reflect typical WordPress role behavior. A plugin or site configuration may add, remove, or change capabilities, so verify what each account can actually do.
Match common work to the least access needed
Use a simple task-to-access review to guide decisions. The examples below are starting points, not automatic assignments:
- Drafting posts: A Contributor role may work when someone should prepare content but not publish it. If the person needs to publish their own posts, an Author role may be more suitable.
- Editing and publishing site content: An Editor role may be appropriate when the person must manage other users’ content as well as their own. If they only work on a limited set of pages or posts, check whether a more restricted option is available on your site.
- Moderating comments: Confirm which role or specific capability enables the required moderation work. Avoid adding broader permissions just to solve one task.
- Changing settings or managing users: These tasks may require Administrator-level capabilities. Limit them to named individuals responsible for site administration.
- Installing or updating themes and plugins: This is technical work with the potential to affect the site. Grant the required capabilities only to the person doing that work, and review elevated access when the task is complete.
If standard roles do not fit, ask a qualified site administrator to check whether a custom role or capability adjustment is appropriate. For a broader security review, see this guide to securing a WordPress site.
Set clear boundaries for agency access
A web agency should receive access based on the work it has agreed to perform. Content support may call for content permissions; a technical change to a theme or plugin may require more. Before granting access, agree on the tasks, the capabilities needed, and when elevated access will be reviewed or withdrawn.
Create an individual account for each agency worker who needs to sign in. Avoid a shared client login. Individual accounts make it easier to give each person an appropriate role and to identify which account needs attention when a project or staff assignment changes.
Administrator access is not automatically necessary for every agency engagement. If the work requires administrative changes, decide who needs that access and for how long. When the work ends, remove or reduce access rather than leaving elevated permissions in place by default. If you are choosing a provider, this article on evaluating a WordPress management provider can help you consider the working relationship.
Use named accounts instead of shared logins
Each person who uses the WordPress dashboard should have their own account. A shared Administrator account makes it difficult to know whose account performed an action and prevents you from tailoring access to each person’s responsibilities. It also makes a staff change harder to manage because changing shared credentials can disrupt other users.
Use a unique account for employees and outside workers, and avoid reusing an account after its original owner leaves. Make sure account recovery details are controlled by the business, not solely by a departing employee or contractor.
Review access when responsibilities change
WordPress user offboarding should be part of a broader access review. When someone changes jobs, leaves the business, or finishes a contract:
- Review the account and its capabilities. Check the assigned role and any custom permissions. Do not rely only on the role label.
- Decide what happens to their content. Identify posts or other material associated with the account. If you delete a WordPress user, the site may offer the option to reassign that user’s content to another account or delete it. Choose deliberately so important content is not removed unintentionally.
- Remove or reduce WordPress access. Disable access that is no longer needed. If the person still has a role, make sure it matches their new responsibilities.
- Check access outside the dashboard. Review hosting, domain registration, connected services, and any other accounts the person used to manage the site. WordPress access is only one part of website access.
- Confirm ownership and continuity. Ensure the business retains control of essential accounts, content, and recovery information.
Do not wait for a departure to review permissions. Revisit access when duties change, a project ends, or a user no longer needs a capability. A regular review can also help catch old accounts that no longer have a clear business purpose.
Frequently asked questions
What WordPress role should I give an employee?
Choose based on the tasks they perform, not their job title. Give them the least access that allows them to complete those tasks, and verify the capabilities on your specific site.
Should a web agency have Administrator access to my WordPress site?
Only if the agreed work requires administrative capabilities. Use an individual account, limit access to the people who need it, and review or withdraw elevated access when the work ends.
How do I give a contractor temporary WordPress access?
Create a named account for the contractor and assign a role that matches the agreed work. Set a clear end point for the access review, then remove or reduce permissions when the project is complete. Do not rely on a shared login.
What happens to a user’s posts when I delete their WordPress account?
During deletion, WordPress may let you reassign the user’s content to another account or delete it. Review the content first and choose the option that preserves the site’s intended ownership and continuity.
How often should I review WordPress user permissions?
Review access when someone’s responsibilities change, when a contract or project ends, and as part of your regular account review. The key is to remove access when it is no longer needed rather than leave old permissions in place.
Keep access intentional
WordPress access is easier to manage when every account belongs to one person, each role supports a defined task, and permissions are revisited as work changes. Start by reviewing your current users and identifying accounts with more access than their responsibilities require. If you would like help with WordPress website management or consulting, contact Zevonix Cloud to discuss your site’s needs.