WordPress User Roles and Permissions Security Guide

WordPress user roles and capabilities control who can do what on your site. Properly configured permissions are fundamental to security, implementing the principle of least privilege where users have only the access they need.

Default WordPress Roles

Understanding built-in roles helps you assign appropriate access levels:

Administrator

Full site access including:

• Plugin and theme management
• User management
• Settings configuration
• All content operations

Security note: Limit administrator accounts. Most sites need only one or two.

Editor

Content management capabilities:

• Publish and manage all posts
• Moderate comments
• Manage categories and tags
• Cannot access settings or plugins

Author

Limited content creation:

• Publish own posts only
• Upload media files
• Cannot edit others' content

Contributor

Draft creation without publishing:

• Write and edit own posts
• Cannot publish
• Cannot upload media

Subscriber

Minimal access:

• Read content
• Manage own profile
• No content creation

Implementing Least Privilege

Assign the minimum role necessary for each user's tasks:

Role Assignment Guidelines

• Site owners: Administrator (one account)
• Content managers: Editor
• Regular writers: Author
• Guest writers: Contributor
• Members/subscribers: Subscriber

Custom Roles and Capabilities

Create custom roles when default roles don't fit your needs.

Creating Custom Roles

// Add custom role
add_role(
    'content_manager',
    'Content Manager',
    array(
        'read' => true,
        'edit_posts' => true,
        'edit_others_posts' => true,
        'publish_posts' => true,
        'delete_posts' => true,
        'upload_files' => true,
    )
);

Modifying Capabilities

// Add capability to role
$role = get_role('editor');
$role->add_cap('manage_categories');

// Remove capability
$role->remove_cap('delete_others_posts');

User Management Security

Registration Controls

• Disable public registration if not needed
• Set default role to Subscriber
• Require email verification
• Use CAPTCHA on registration forms

User Auditing

Regularly review user accounts:

• Remove unused accounts
• Verify role assignments
• Check for unauthorized administrators
• Review user activity logs

Protecting Sensitive Capabilities

High-Risk Capabilities

• install_plugins - Can install malicious code
• edit_themes - Direct file access
• unfiltered_html - XSS potential
• manage_options - Full settings access
• edit_files - Theme/plugin file editing

Restricting Dangerous Capabilities

// Disable file editing for all users
define('DISALLOW_FILE_EDIT', true);

// Remove unfiltered_html from non-admins
add_filter('map_meta_cap', function($caps, $cap) {
    if ($cap === 'unfiltered_html') {
        $caps[] = 'do_not_allow';
    }
    return $caps;
}, 10, 2);

Plugin-Added Roles

Many plugins add custom roles and capabilities. Review these carefully:

• WooCommerce: Customer, Shop Manager
• Membership plugins: Various member levels
• LMS plugins: Instructor, Student roles

Multi-Author Security

Sites with multiple contributors need additional measures:

• Require post approval for contributors
• Limit media upload types
• Monitor content for malicious code
• Use revision history for accountability

Role-Based Access Control

Implement content restrictions based on roles:

// Restrict content by role
if (current_user_can('editor')) {
    // Show editor-only content
}

// Restrict menu items
add_action('admin_menu', function() {
    if (!current_user_can('manage_options')) {
        remove_menu_page('tools.php');
    }
});

Conclusion

Proper user role management is essential security. Apply least privilege principles, regularly audit accounts, and carefully manage capabilities to maintain a secure WordPress environment.