WordPress user roles for a marketing team: who gets what

When several people on a marketing team log in to WordPress, it is tempting to make everyone an Administrator because it is quicker than working out the right role. But every Administrator can install plugins, change settings and delete other users, and if one of those logins is stolen, the attacker gets the same power. The fix costs nothing: give each person the role their job needs, and no more.

What can each default WordPress role do?

A single WordPress site comes with five roles, each with fewer capabilities than the one above it. WordPress describes roles as responsibilities, not rank.

• Administrator: everything, including plugins, themes, settings, users and editing theme and plugin code from the dashboard.
• Editor: publishes and manages all posts and pages, including other people's, plus categories and comments. No access to plugins, themes, menus, widgets, settings or users.
• Author: writes, publishes and edits their own posts and uploads media, but cannot edit other people's posts or create pages.
• Contributor: writes and edits their own posts but cannot publish them or upload images.
• Subscriber: manages their own profile and nothing else.

Super Admin only exists on a multisite network. There, site Administrators can no longer install or update plugins and themes, or create and delete users: those capabilities belong to the Super Admin.

Who on a marketing team should get which role?

Match the role to the work each person does every week, not to their job title.

• Freelance and occasional writers: Contributor, so every draft waits for review.
• In-house writers you trust to publish their own posts: Author.
• The content lead who reviews and publishes everyone's work, including pages: Editor.
• Whoever owns plugins, updates, settings and users: Administrator, limited to one or two named people. WordPress's security guidance says to limit administrators and use lower roles for day-to-day work.

A head of marketing who signs off content needs Editor, not Administrator. And everyone gets their own account. WordPress requires a unique email address per user, and with a shared login you cannot tell who published or deleted something, or remove one person without changing everyone's password.

What changes if the site runs WooCommerce?

WooCommerce adds two roles: Customer and Shop Manager. People become Customers when they register at checkout or sign up, with limited access similar to a Subscriber. Shop Manager lets someone run the store without full Administrator access: WooCommerce settings and reports, products, orders and refunds, coupons, plus general editor capabilities for posts and pages.

Give Shop Manager to whoever runs orders and promotions day to day. It can still change store settings and issue refunds, so keep it to named people with two-factor on.

Should you add custom roles with a plugin?

Only when a default role is clearly wrong for a job, and then change as little as possible. Plugins create roles with add_role() and add capabilities with add_cap(), and role editor plugins put the same controls on a settings screen. WordPress stores roles and capabilities in the database, so a change stays until someone reverses it.

The usual request is letting Editors edit menus. That means granting edit_theme_options, which also opens Widgets, the Customizer and, on block themes, the Site Editor. That is a bigger change than it sounds, so we document every role change and check it with a test account first.

How do you protect the accounts that can do the most?

Turn on two-factor authentication for every Administrator, Editor and Shop Manager. WordPress core does not include it, so it comes from a plugin or your identity provider, and the WordPress developer handbook recommends it for all privileged users. Pick a plugin that can require it for a role, not only offer it.

Then stop everyone, Administrators included, from editing plugin and theme code in the dashboard:

// wp-config.php
define( 'DISALLOW_FILE_EDIT', true );

WordPress describes this as equivalent to removing the edit_themes, edit_plugins and edit_files capabilities from every user. It will not stop malicious uploads, but nobody can break the site with a quick edit in the theme editor.

What should a regular user review cover?

Review users every quarter and on the day someone leaves. On the Users screen, filter by role and check:

1. Is every Administrator a named person who still needs it? Use Change role to for anyone who does not.
2. Has anyone left? Delete the account, choose Attribute all posts and links to, and pick a current colleague. The other option deletes their posts too.
3. Is any account called admin? WordPress advises against that username, and usernames cannot be changed, so create a new Administrator and remove the old one.
4. On each Administrator's profile, revoke Application Passwords nobody recognises.
5. In Settings, General, leave Anyone can register unchecked unless you need sign-ups, and set New User Default Role to Subscriber.
6. Is two-factor on for every account with Editor rights or higher?

To keep a former writer's byline on their articles, keep the account as a Subscriber, set a new password and change the email to one your company controls.

Where to start

Open Users today and count your Administrators. More than two, a shared login or a former colleague is the first fix. If you would like help with roles and security settings, our WordPress development team can review the setup, or start with a website review.