How to Set Up WordPress User Roles and Permissions for a New Website

When you’re the only person working on a WordPress site, access control isn’t something you think about. Add someone else to the mix — a writer, a developer, a client who needs to review a page — and the question of who can do what suddenly matters.

WordPress handles this with a built-in roles system. Each role comes with a fixed set of permissions, and you assign one to each user account. The result is a site where writers can write, editors can edit, and only the people who genuinely need to change settings have access to the admin area.

Getting this right takes about ten minutes. Getting it wrong means running a site where everyone is an Administrator, one accidental click can delete a plugin, and there’s no clear line between who manages content and who manages the site. If you’re working through the step-by-step guide to building a WordPress website, setting up user roles should come early — ideally alongside your core WordPress settings before anyone else starts working on the site.

Quick Answer

WordPress has five main user roles: Administrator, Editor, Author, Contributor, and Subscriber. Each one restricts what that user can see and do. Assign roles via Users → Add New or Users → All Users, then choose from the Role dropdown. The principle: give each user only the access they actually need.

Why User Roles Matter

Giving everyone Administrator access is the most common mistake on WordPress sites. It feels like the easy option when you’re adding people quickly, but it creates real problems. An Administrator can install and delete plugins, change site settings, add new users, and delete any content on the site. One mistake — or one compromised account — can break things completely.

Proper roles also make the site easier to work with. Writers see a simplified dashboard with just the tools they need. Editors can manage and publish content without touching site settings. Admins focus on configuration, not day-to-day content work. Everyone’s responsibilities are clear.

How to Set Up WordPress User Roles

Step 1 — Understand the Five Default Roles

WordPress ships with five roles, each more restricted than the last:

• Administrator — full access to everything: settings, plugins, themes, users, and all content
• Editor — can publish, edit, and delete any post or page, including other users’ content; can manage categories and moderate comments
• Author — can write, edit, and publish their own posts; can upload media
• Contributor — can write and edit their own posts but cannot publish them or upload media
• Subscriber — can only read content and manage their own profile

For most WordPress sites, the roles you’ll use regularly are Administrator, Editor, and Author. Contributor is useful for managing guest writers; Subscriber is mainly for membership sites or gated content.

Step 2 — Add a New User

1. In your WordPress dashboard, go to Users → Add New
2. Enter a username, email address, and a strong password
3. Select the appropriate role from the Role dropdown
4. Click Add New User

The user receives an email with login details and can access the site immediately. The role you assign is editable at any time — you can upgrade or downgrade it from Users → All Users.

Step 3 — Match Roles to Actual Responsibilities

The most practical approach is to match the role to what the person actually does on the site, not to their seniority or how well you know them.

• Site owner: Administrator
• Content manager or senior writer: Editor
• Regular writers who publish their own posts: Author
• New or guest contributors: Contributor — gives you a review step before anything goes live
• Registered members or customers: Subscriber

If someone needs temporary Administrator access — a developer fixing a bug, for instance — give it to them, let them complete the work, then downgrade the account or remove it entirely once the job is done.

Step 4 — Review Existing Users

If your site has been running for a while, go to Users → All Users and check what roles are currently assigned. Look for:

• Former writers or freelancers whose accounts are still active
• Accounts with Administrator access that no longer need it
• Test accounts that should be deleted

Inactive accounts with elevated access are a genuine security risk. Reviewing and cleaning up the user list is a standard part of any WordPress security audit, and it’s worth doing as a habit rather than a one-off task.

Step 5 — Keep Administrator Access Minimal

As a rule, no more than one or two people should hold Administrator access on any single site. That typically means you and, if necessary, a trusted developer or technical partner.

Everyone else gets the lowest role that still allows them to do their job. In most sites I build, the first thing I do after the initial setup is verify that only the site owner has Administrator access and everyone else is working at a lower level.

Practical Tips

Use Contributor for writers you don’t know well yet. Their posts sit as drafts until an Editor or Administrator publishes them, which gives you a review step without adding much friction to the workflow.

If you’re bringing in an outside writer specifically as a one-off guest contributor rather than a regular team member, this guide to managing guest contributors covers the brief, review, and byline steps worth setting up alongside the Contributor role itself.

Don’t leave a generic “admin” account active. If you installed WordPress with a default username, create a proper account with your real name and Administrator role, then delete or demote the old account. Generic usernames are a common target for brute-force login attempts.

Update roles when people leave. When a writer finishes a project or a developer ends a contract, change their role or remove their account immediately. This is easy to forget and easy to leave unaddressed for months.

For sites that need more granular control — specific pages accessible only to certain users, or custom roles with selected capabilities — role management plugins can extend the built-in system without requiring any code changes.

Common Mistakes

Making everyone an Administrator. The most common mistake and the most consequential. An Administrator can change settings, install and delete plugins, remove other users, and break the site. Reserve it for people who genuinely need it.

Not removing accounts when people leave. Stale accounts are a real security liability. Get in the habit of cleaning the user list whenever someone’s involvement with the site changes.

Giving a developer permanent admin access. Developers often need admin access during a project, but it should be temporary. Once the work is done, remove or downgrade the account.

Using Subscriber when someone needs to submit content. Subscribers can only manage their profile and read content. If someone needs to write posts, they need at least Contributor access.

When to Use Custom Roles

The built-in roles cover the vast majority of WordPress sites. Where they fall short is in edge cases: a team member who should edit pages but not posts, a membership site where paying users see different content from free users, or a setup where media uploads need to be restricted to specific accounts.

For those situations, the WordPress roles and capabilities documentation covers exactly which capabilities each role holds and how to build custom roles. Several well-maintained plugins also provide a visual interface for editing roles without touching code.

Conclusion

Set up user roles before you add anyone to the site. Match each role to what that person actually needs to do, keep Administrator access to a minimum, and review the user list whenever someone’s involvement with the site changes. Those three habits are what keep a WordPress site secure and well-managed as it grows.