What is a User Role in WordPress?

After you install WordPress, the platform automatically creates an Administrator account for you. Every user you add after that holds a role, and the role decides which screens they see and which actions they’re allowed to take.

The six default roles

From most to least powerful:

• Super Admin: manages an entire multisite network, including creating and deleting sites and handling network-wide users, themes, and plugins.
• Administrator: full control of a single site, from activating plugins and themes to changing settings and managing users.
• Editor: publishes and manages posts and pages, including content written by other users.
• Author: writes, edits, and publishes their own posts only.
• Contributor: writes and edits their own posts but can’t publish them; an Editor or Administrator reviews and publishes the work.
• Subscriber: logs in and manages their own profile, nothing more.

On a standard single-site install you’ll see 5 of these, not 6. Super Admin only appears when the multisite feature is enabled; until then, Administrator is the top role, and a single-site Administrator is, in effect, the Super Admin.

Roles vs. capabilities

A role is a named bundle of capabilities, the individual permissions WordPress actually checks. publish_posts, moderate_comments, and edit_users are all capabilities. When a user tries to do something, WordPress doesn’t ask which role they hold; it asks whether that role carries the capability the action requires. An Editor can edit another writer’s post because the role includes edit_others_posts, not because “Editor” outranks “Author.”

Roles are adjustable, too. Developers can add or remove capabilities from any role with the add_cap() and remove_cap() functions, so the same role can behave differently from site to site.

How to change a user’s role

Go to Users > All Users, click the account, and pick a new role from the Role dropdown. To update several accounts at once, tick them and use the “Change role to…” dropdown at the top of the list. Changing another user’s role requires the promote_users capability, which Administrators receive by default; a custom role granted that capability can manage roles, too. On a multisite network, user management across the whole network is reserved for the Super Admin.

The setting at Settings > General does something different: its “New User Default Role” dropdown sets the role automatically assigned to newly registered accounts. It never changes existing users.

Custom and plugin roles

The six defaults aren’t a fixed menu. Developers register new roles with add_role(), and role-editor plugins let you do the same from the dashboard without touching code. Plugins create their own roles, too: WooCommerce, for example, adds Customer and Shop Manager when you install it. If your Users screen lists roles that aren’t in the list above, a plugin almost certainly put them there.

Which role to give a new user

Give each person the least powerful role that still lets them do their job: Contributor for a guest writer whose work you review before it goes live, Author for a trusted regular writer, and Editor for whoever runs your content. Reserve Administrator for people who actually need to manage settings, plugins, themes, or users, and keep that group as small as your operations allow.

Each Administrator account you add widens your site’s attack surface. On a default single-site install, someone who breaks into one can usually change users, settings, themes, and plugins, though site configuration and multisite rules can restrict some of those actions. Protect every Administrator account with a strong password and multifactor authentication. To change a user’s role step by step, or to build a custom one, see our guide to WordPress user roles.