If more than one person works on the website, this is where you decide who is allowed to do what.
The most common mistake: everyone gets Administrator.
The five roles
Administrator
Can do everything: install plugins, change the theme, delete users, change settings. Two people at most should have it.
Editor
Can write, edit and publish — including other people’s articles. Can’t touch plugins or settings.
This is the right role for whoever runs the content.
Author
Writes and publishes their own articles. Doesn’t touch anyone else’s.
Contributor
Writes, but can’t publish — only drafts that an editor will review.
Good for outside contributors.
Subscriber
Can only read and edit their own profile. For websites with logins.
The rule
The lowest role with which the person can get the job done.
Someone who writes articles doesn’t need access to plugins. If their account is compromised, the damage is limited.
When someone leaves
Don’t keep the account “just in case”. An inactive admin account with an old password is a hole left open.
When you delete a user, WordPress asks what to do with their content — it can be attributed to another user. Choose someone; don’t delete it.
The username “admin”
If the main administrator is called admin, half of the attacker’s work is already done — all they need is the password.
A username can’t be changed from the admin. The way around it: create a new administrator with a different name, log in with it, delete the old one and attribute its content to the new account.
Two-factor login
A plugin such as Wordfence or Two Factor enables it. Then a stolen password isn’t enough.
Turn it on at least for administrators. It takes a few minutes and stops the most common login attempts.
Profile
Every user edits their own: name, email, password, how they appear on articles.
A small detail: “Display name publicly as” decides what is shown under the article. If it shows the username, that makes the attacker’s job easier. Use a real name or a pen name.
Don’t want to maintain WordPress yourself — updates, backups and security? We take care of it.
WordPress maintenance →