WordPress's role system is more capable than most sites actually use — it's common to see every team member, contractor, and client running as Administrator simply because nobody set up anything more granular. That's both a usability problem (too much power, too little guardrail) and a real security exposure, since every additional full-admin account is another account that, if compromised, gives an attacker complete control.
The default roles, and what they're actually for
- Administrator — full control, including plugin/theme installation and other users' accounts. Should be reserved for people who genuinely need that level of access, not the default for "trusted" staff.
- Editor — full control over content (any post/page, not just their own), but no site configuration or plugin/theme access. The right fit for a content manager overseeing multiple writers.
- Author — can publish and manage their own posts, not others'. Good for regular contributing writers who don't need editorial oversight of the whole site.
- Contributor — can write and edit their own posts, but not publish them; posts need Editor/Administrator review first. Useful for guest writers or a formal editorial-review workflow.
- Subscriber — minimal access, essentially just a logged-in identity (commenting, viewing gated content). The right default for customer/member accounts that shouldn't touch content at all.
The capability system underneath roles
Roles are really just named bundles of individual capabilities (edit_posts, publish_posts, manage_options, etc.) — you're not limited to the five defaults. Custom roles with a specific capability set (a "Shop Manager" who can manage products and orders but nothing else, a "SEO Editor" who can edit metadata but not publish) are straightforward to define and often a better fit than stretching a default role to cover a job it wasn't designed for.
The principle that should drive every role decision
Grant the minimum capability set that lets someone do their actual job — not the most convenient role to avoid future permission requests. This isn't just tidiness: it directly limits the damage from a compromised account (phished credentials, a weak password, a malicious insider) and from simple human error (an overprivileged user accidentally changing something outside their actual responsibility).
Membership and gated-content sites: roles are your access control
For a membership site, user roles (often extended by a dedicated membership plugin) become the actual mechanism controlling who sees what — free vs. paid tier content, course access, community areas. A few things matter specifically here:
- Gate content at the query/template level, not just by hiding a link in navigation — a hidden link is not access control; the underlying page or endpoint must itself check the user's role/capability before rendering protected content.
- Handle role transitions on payment events correctly — a cancelled subscription should demote the user's role/capability promptly, not leave them with paid access indefinitely because the downgrade logic wasn't wired to the actual billing event.
- Audit third-party membership and LMS plugins for how they store gating logic — some rely on post meta checks that a determined user could bypass via direct URL access if the plugin's gating isn't applied consistently across every content-serving path (REST API, feeds, search results), not just the main template.
Auditing existing accounts
If a site has accumulated Administrator accounts over time without review, audit them:
- Are there accounts for people who no longer work with the site? Deactivate/remove them.
- Is anyone running as Administrator who genuinely only needs Editor or a custom role?
- Are shared/generic accounts ("client", "admin2") in use? Individual accounts per person, not shared logins, is both better security practice and the only way audit logs mean anything.
The takeaway
WordPress's role system can express real, granular access control — most sites just don't use it, defaulting everyone to Administrator out of convenience. Assigning the least privilege each person or membership tier actually needs, and auditing that periodically, closes a meaningful and commonly overlooked security gap.
