Skip to main content

How to Add Users and Set Roles in WordPress

Using Joomla instead? See How to Add Users and Set Permissions in Joomla.

Giving each person their own login, with only the access they need, keeps your site safer and makes it easier to see who changed what.

WordPress roles

WordPress has five standard roles on a single site:

  • Administrator: full control, including plugins, themes, settings, and users. Keep this to as few people as possible.
  • Editor: can publish and manage all posts and pages, including other people's.
  • Author: can write, publish, and manage their own posts.
  • Contributor: can write their own posts but can't publish them.
  • Subscriber: can only manage their own profile.

(Multisite networks also have a Super Admin.) Plugins such as stores or membership tools may add their own roles.

Add a user

  1. Log in at yoursite.com/wp-admin.
  2. Go to Users > Add New User (labeled Add New in some versions).
  3. Enter a Username, Email, and optionally first and last name.
  4. Leave Send User Notification ticked so they get an email to set their password.
  5. Choose a Role.
  6. Click Add New User.

Change someone's role

  • Open Users > All Users, click the person's username, change Role, and click Update User.
  • Or tick several users and use Change role to above the list, then click Change.

Remove former staff

Do this as soon as someone leaves.

  1. In Users > All Users, hover over the user and click Delete.
  2. WordPress asks what to do with their content. Choose Attribute all content to and pick another user so their posts and pages stay on the site.
  3. Click Confirm Deletion.

If you'd rather not delete them yet, change their role to Subscriber and reset their password. Also change any shared passwords they knew, like hosting or FTP.

Two-factor authentication

WordPress doesn't include two-factor authentication. Your security plugin may add it. Turn it on for anyone with Administrator or Editor access.

Review users regularly

A few times a year, go through Users > All Users and remove accounts that aren't needed.

Related

Prefer we handle it?

If you'd rather spend your time running your business, our boutique hosting, available to our clients, including sites moved over from another host, takes a proactive approach to security and monitoring, with nightly backups, 24/7 outage monitoring, and ongoing core CMS updates.

Hosting & Security