Sooner or later, someone other than you needs to get into your website. Maybe you’re hiring a developer to fix something, bringing on a virtual assistant to upload blog posts, or adding a staff coach to help run your membership.
Here’s the thing most coaches get wrong: they just hand over their own username and password. Please don’t do that. Instead, create a separate user account for that person and give them the right level of access, no more and no less.
I’ve been building websites for coaches since 2018, including big membership sites with whole teams logging in, and getting WordPress user roles right is one of the simplest ways to keep your site safe from accidental damage.
In this post, I’ll walk you through all five roles, which one to give your developer (or VA, or guest blogger), how to add a new user step by step, and how to keep everything secure once other people have the keys.
Here’s what we’ll cover:
- What are WordPress user roles?
- The 5 WordPress user roles and permissions, explained
- What user role should I give my web developer?
- How to add a new user in WordPress
- Keeping your site secure when other people have access
- Frequently asked questions
A quick look at the 5 roles
Before we get into the detail, here’s the cheat-sheet version of who can do what:
- Administrator — can do everything. Best for you and your developer.
- Editor — can publish and manage all posts and pages, including other people’s. Good for a content manager.
- Author — can write, edit, and publish their own posts only. Good for a regular guest contributor.
- Contributor — can write and edit their own posts but can’t publish them. Good for a one-off guest or someone whose work you want to review first.
- Subscriber — can only manage their own profile. Good for members or commenters.
Keep that list handy. The whole game here is matching the person to the smallest role that still lets them do their job.
What are WordPress user roles?
A WordPress user role is a setting that controls what a person can and can’t do inside your website’s backend. Each role comes with its own set of permissions, so an Administrator can change anything, while a Subscriber can barely change a thing. Assigning the right role keeps the right people in the right lanes so no one accidentally breaks something they shouldn’t have touched.
Think of it like your online team, where each person has their own job and their own set of keys. Your developer needs the master key to the whole building. The person answering questions for your members only needs the key to one room. You’re not locking anyone out, you’re just making sure each person has exactly the access their job requires and nothing extra that could cause trouble.
The 5 WordPress user roles and permissions, explained
WordPress comes with five built-in roles. Here’s what each one can actually do, and the kind of team member it’s a good fit for.
Administrator
The Administrator can do it all. Install plugins, change your theme, edit any page or post, delete content, add and remove other users, update your core software, everything.
This is the most powerful role on your site, so treat it with care. It’s like handing over the master key to your entire online presence. I only recommend giving Administrator access to people you genuinely trust with the whole thing, usually that’s you and your developer.
Editor
An Editor can publish and manage posts and pages, including ones written by other people. They can also moderate comments and manage categories.
What they can’t do is touch the structural stuff, like installing plugins, changing themes, or managing other users. That makes Editor a great fit for a content manager or a trusted VA who handles your blog and website content but doesn’t need to get into the site’s settings.
Author
An Author can write, edit, and publish their own posts, but only their own. They can’t touch anyone else’s content, and they can’t get into pages or site settings.
This works well for a regular guest contributor who writes for your blog often enough that you trust them to hit publish without you checking every time.
Contributor
A Contributor can write and edit their own posts, but they can’t publish them. Their work sits in a queue for you (or an Editor) to review and publish.
It’s the perfect role for a one-off guest writer, or anyone whose work you’d like to look over before it goes live. You get their content without giving up editorial control.
Subscriber
A Subscriber can only manage their own profile, like updating their name or changing their password. They can’t create or edit any content at all.
If you run a membership or a site where people log in to comment or access gated content, Subscriber is the role most of your members will have.
What user role should I give my web developer?
Give your web developer the Administrator role. A developer needs full access to install plugins, edit your theme, and work in the backend, so Administrator is the right call. Just make sure it’s someone you trust, and consider removing their access once your relationship is done.
For everyone else, here’s my quick rule of thumb:
- Web developer → Administrator
- VA or content manager who handles your blog and pages → Editor
- Frequent guest blogger you trust to publish → Author
- One-off or first-time guest writer → Contributor
- Members, students, or commenters → Subscriber
The principle underneath all of it: give people the least amount of access they need to do their job.
A real example of why “least access” matters
When my team was building a large membership site for my client Jody Moore, she had a handful of staff coaches who logged in to answer member questions. On the old site, they’d been set up as Editors, which meant they could also edit pages and posts across the whole site.
This wasn’t great for their team, because:
- The business really didn’t want them changing stuff outside their job.
- The coaches didn’t have peace of mind that they wouldn’t accidentally break something they weren’t supposed to touch.
So when we built the new site, we used tools that allowed us to only give those coaches access to the areas they needed. It was a security upgrade and a peace-of-mind upgrade at the same time.
How to add a new user in WordPress
Ready to actually add someone? It’s quick. Here’s how to add a new user to your WordPress site, step by step.
Step 1: Go to Users » Add New. From your WordPress admin dashboard, find Users in the left-hand menu and click Add New User.
Step 2: Fill out the new user’s details. Username and email address are required. You can also add their first name, last name, and website if you’d like, but those are optional.
Step 3: Set the password. WordPress automatically generates a very secure password for you. You can use that one, or create your own by mixing uppercase, lowercase, numbers, and symbols. Either way, make sure it’s strong.
Step 4: Choose the user role. This is the important one. Use the Role dropdown to pick the role that matches what this person needs to do. If you’re adding your web developer, choose Administrator so they have the full access they need to work on your site.
Step 5: Click Add New User. That’s it. WordPress can email the new user their login details, or you can send them over yourself.
Keeping your site secure when other people have access
Adding users safely is really just one piece of keeping your WordPress site secure. Once you’ve got the roles sorted, a few habits go a long way:
Stick to least privilege. I’ll say it one more time because it’s the whole point: give each person the smallest role that lets them do their job. It’s the single easiest way to prevent accidental damage.
Remove access when people leave. When a contractor finishes a project or a team member moves on, delete their user account or downgrade it. Old accounts you’ve forgotten about are exactly the kind of thing that becomes a security hole.
Use strong, unique passwords. Every user on your site should have one. A password manager makes this painless, and it matters more than ever now that automated attacks on WordPress sites are getting smarter.
If reading all this makes your stomach drop a little, that’s exactly what a website care plan is for. My team and I handle the updates, backups, and security so you can stop worrying about your site and get back to coaching.
Frequently asked questions
What user role should I give my web developer?
Give your developer the Administrator role. They need full access to install plugins, edit your theme, and work in your site’s backend, and Administrator is the only role that allows all of that. Just make sure it’s someone you trust, and consider removing their access once your work together is done.
Can I limit what a user can do in WordPress?
Yes. WordPress’s five built-in roles each come with their own permissions, so choosing the right role is the first way to limit access. If you need even tighter control, like letting someone access just one area of your site, that’s possible too, usually with a plugin like PublishPress Capabilities or some custom setup by a developer.
How do I remove a user from WordPress?
Go to Users » All Users, hover over the person you want to remove, and click Delete. WordPress will ask what to do with any content they created, so you can delete it or reassign it to another user. Removing accounts you no longer need is a smart security habit.
How do I change a user’s role in WordPress?
Go to Users » All Users, check the box next to the person whose role you want to change, then use the “Change role to…” dropdown at the top of the list and click Change. You can also open their profile individually and update the Role field there.
Is it safe to give someone access to my WordPress site?
It’s safe as long as you give each person their own user account with the right role, never your own login, and stick to the least amount of access they need. Use strong, unique passwords, and remove accounts when people no longer need them. Done that way, sharing access is perfectly secure.
You’ve got this
Adding a user to WordPress is genuinely simple once you understand the roles. Match each person to the smallest role that lets them do their job, use a separate account for everyone (never your own login), and clean up access you no longer need.
And if you’d rather not be the one keeping track of all the user roles on your site and adding people, that’s what I’m here for. Take a look at my website care plans.
Read more: How to Care for Your WordPress Website
