Users & Roles

By the end of this lesson you will add team members to your site with exactly the access they need, no more and no less. You will also understand how WordPress decides who can do what, and how developers check that in code.

Why roles matter

Imagine a coaching centre office. The owner holds every key. The office manager can edit notices and approve them. A teacher can write notices but someone must check them. Parents can only read. Nobody hands the main locker key to every visitor.

WordPress works the same way. Each user gets a role. A role is a bundle of capabilities, which are single permissions such as publish_posts or install_plugins.

The built-in roles

Pick the lowest role that lets a person do their job. This idea is called the principle of least privilege. If a teacher's password is stolen, a Contributor account can do far less damage than an Administrator account.

Adding a user, step by step

Let us add Farhan, a physics teacher who will write exam tips that the manager approves.

Step 1: Go to Users > Add New User.

Step 2: Enter a username (farhan.physics), his email, and his first and last name. The username cannot be changed later, so choose carefully.

Step 3: WordPress fills in a strong generated password. Keep it, and tick Send User Notification so Farhan gets an email with a link to set his own password.

Step 4: Set Role to Contributor.

Step 5: Click Add User. You return to the user list and see Farhan with the role Contributor.

Now log in as Farhan in a private browser window. You should see a smaller menu: Dashboard, Posts, Comments, Profile and Tools. When he writes a post, the button says Submit for Review instead of Publish. The Editor or Administrator then sees it as Pending and can publish it.

Changing and removing users

• To change a role, go to Users > All Users, tick the user, choose Change role to... above the list, and click Change.
• When someone leaves, delete their account. WordPress asks what to do with their content. Choose Attribute all content to another user, so their posts are not deleted with them.
• If you are not sure, first change their role to Subscriber. They can log in but cannot change anything.

Profiles and display names

Each user can open Profile to set a nickname and choose a display name. The display name appears on posts as the author. It is better to show "Meera Sharma" than a login name like meera_admin42, because showing login names gives attackers half of what they need to log in.

Checking capabilities in code

Developers do not usually check role names. They check capabilities, because a plugin can create custom roles with different bundles. The function current_user_can() answers "Is the logged-in user allowed to do this?"

<?php
if ( current_user_can( 'edit_posts' ) ) {
    echo 'You can write posts.';
} else {
    echo 'Please ask the office to give you writing access.';
}

If Farhan (a Contributor) is logged in, this prints:

You can write posts.

A Subscriber would see the second message. Here are a few useful capabilities and which roles have them by default:

manage_options is the classic check for "can change site settings", which normally means Administrator.

Advanced: a custom role

You can create your own role for special jobs. This creates a "Results Manager" who can read and upload files, for example to publish result PDFs, but nothing more:

<?php
// Run once, for example when your plugin is activated.
add_role(
    'results_manager',
    'Results Manager',
    [
        'read'         => true,
        'upload_files' => true,
    ]
);

Roles are saved in the database, so add_role() should run once, usually on plugin activation, not on every page load. To undo it, call remove_role( 'results_manager' );.

Users from the command line

WP-CLI can create users quickly. This makes an Author account and prints the new user ID:

wp user create isha isha@example.com --role=author --send-email --porcelain

5

--porcelain prints only the ID. Without it, WP-CLI also prints the generated password on screen, so --send-email plus --porcelain is the safer habit: Isha sets her own password from the email.

Application passwords

Under Users > Profile there is a section called Application Passwords. These are separate passwords for apps and scripts that talk to your site through the REST API. You can revoke one without changing your main password. You will use them in The WordPress REST API.

Common mistakes

• Making every staff member an Administrator "to save time". One stolen password then gives full control.
• Using admin as a username. Attackers try it first.
• Deleting a user without reassigning content. Their posts disappear too.
• Allowing open registration with a high default role. Keep New User Default Role as Subscriber in Settings > General.
• Checking role names in code ('editor') instead of capabilities ('edit_others_posts').

Key points

• Every user has a role, and every role is a bundle of capabilities.
• The six roles are Super Admin, Administrator, Editor, Author, Contributor and Subscriber.
• Give each person their own account with the lowest role that fits the job.
• When deleting a user, attribute their content to someone else.
• Check permissions in code with current_user_can() and a capability name.
• add_role() saves to the database, so run it once on activation.

<?php
if ( current_user_can( 'manage_options' ) ) {
    echo '<a href="' . esc_url( admin_url( 'options-general.php' ) ) . '">Settings</a>';
}