WordPress User Roles & Permissions Explained

WordPress ships six roles — Super Admin (multisite only), Administrator, Editor, Author, Contributor and Subscriber — each a bundle of capabilities that decides who can publish, edit others' work or change the site itself. Give every person the lowest role that fits their job.

Roles are managed under Users in wp-admin, and new sign-ups receive the default set under Settings › General › New User Default Role, which should stay at Subscriber.

Match the role to the work: Author for a writer who publishes finished posts, Contributor for one whose work needs review, Editor for the person running the content calendar, and Administrator only for the site owner.

• Clients who only update content: Editor, not Administrator; one compromised admin login exposes plugins, files and every setting.
• Agencies: work as Administrator during the build, then hand the admin account and documentation to the owner and keep only the access still needed.
• Plugin-specific roles: WooCommerce adds Shop Manager (orders, products, reports) and Customer; give staff Shop Manager rather than Administrator.
• Departed staff: delete or downgrade their account the day they leave, reassigning their posts to another user.

Least privilege is the cheapest security control on any site; it pairs with two-factor login, as set out in WordPress two-factor authentication. WebJi®'s WordPress security services cover wider hardening if you want it handled for you.

Use a role-editor plugin such as Members or User Role Editor, or register a role in code with add_role(), giving it only the capabilities the job needs. Because roles are stored in the database, code like this should run once, for example on plugin activation, not on every page load.

add_role(
    'seo_manager',
    'SEO Manager',
    array(
        'read'                 => true,
        'edit_posts'           => true,
        'edit_others_posts'    => true,
        'edit_published_posts' => true,
        'edit_pages'           => true,
        'edit_others_pages'    => true,
    )
);

This role can edit content, including other people's, but cannot publish new posts, install plugins or change settings. Capabilities overlap more than they appear — edit_theme_options, for example, opens menus, widgets and the Site Editor — so test any new role with a throwaway account before handing it out.