When a business website grows, more people need access: a marketing officer who writes blog posts, a sales assistant who updates products, a freelancer who fixes the design. Many organisations simply make everyone an Administrator. That is risky. Understanding WordPress user roles helps teams work together while protecting the site from mistakes and attacks. This guide explains each default role, how to assign them and good practice for teams in Uganda and beyond.
What are WordPress user roles?
A role is a set of permissions, called capabilities, that controls what a user can do in the WordPress dashboard. When you add a user, you choose their role. WordPress comes with five main roles on a standard site, plus a sixth on multisite networks.
The principle behind good role management is simple: give each person the least access they need to do their job.
The default roles, from most to least powerful
Super Admin (multisite only)
Exists only on WordPress multisite networks, where one installation runs many sites. A Super Admin manages the entire network, including adding sites, installing themes and plugins for all sites and managing users across the network. Most small business sites do not use multisite.
Administrator
Full control over a single site. Administrators can:
- Install, update and delete plugins and themes
- Change all settings
- Add, edit and delete users, including other administrators
- Edit and delete any content
Who should have it: the business owner or a trusted senior person, and your web developer or support provider when needed. Keep the number small, ideally one or two people.
Editor
Editors manage all content but cannot change site settings, plugins or users. They can:
- Create, edit, publish and delete any posts and pages, including those by others
- Moderate comments
- Manage categories and tags
- Upload media
Who should have it: a communications manager, content lead or marketing head who oversees what gets published.
Author
Authors can write, edit, publish and delete their own posts, and upload images. They cannot touch other people's posts or pages.
Who should have it: regular staff writers or team members trusted to publish blog posts directly.
Contributor
Contributors can write and edit their own posts but cannot publish them. Their drafts must be reviewed and published by an Editor or Administrator. By default, they also cannot upload images.
Who should have it: interns, guest writers, new staff or anyone whose work should be reviewed before going live.
Subscriber
Subscribers can log in and manage their own profile, and nothing else in terms of content. This role is mainly used for membership sites or for readers who register to comment.
Roles added by plugins
Some plugins add their own roles. For example, WooCommerce typically adds a Shop Manager role, which can manage products, orders and reports without full administrator rights, and a Customer role for shoppers. SEO, LMS and membership plugins may add others. Check what each role can do before assigning it.
Example role setup for a small team
Imagine an events company in Kampala with a website and online ticket shop:
- Managing director: Administrator
- Web support provider: Administrator, with a separate named account
- Marketing manager: Editor
- Social media officer: Author
- Intern writing event recaps: Contributor
- Sales officer handling ticket orders: Shop Manager
Each person can do their job, nobody can accidentally break the site settings, and every change is traceable to a named account.
How to add a user and assign a role
- Log in as an Administrator.
- Go to Users, then Add New.
- Enter a username, the person's work email address and their name.
- Let WordPress generate a strong password, or have the user set their own through the email link.
- Choose the appropriate role from the dropdown.
- Click Add New User.
To change a role later, go to Users, hover over the user, click Edit, change the role and click Update User.
Good practice for teams
- One person, one account. Never share a single login among staff. Shared accounts make it impossible to know who did what and hard to remove access.
- Use work email addresses. Accounts linked to business email, such as name@yourcompany.co.ug, stay under company control.
- Enable two factor authentication, especially for Administrators and Editors.
- Review users regularly. Every few months, check the Users list and remove or downgrade people who no longer need access.
- Remove access promptly when staff leave or a contractor finishes. Reassign their content to another user when deleting.
- Avoid the username "admin". It is the first one attackers try.
- Use an activity log plugin if many people edit the site, so you can see who changed what.
Customising roles
If the default roles do not fit, role editor plugins let you create custom roles or adjust capabilities. For example, you might allow Contributors to upload images, or create a "Content Reviewer" who can edit but not publish. Make changes carefully and document them, because overly broad custom roles can undo the security benefits of role management.
Frequently asked questions
What role should my web designer have?
During development, Administrator is usually necessary. After launch, consider downgrading or removing their account, and re-enable access when they need to do work.
Can an Editor install plugins?
No. Only Administrators (and Super Admins on multisite) can install plugins and themes by default.
Why can my Contributor not upload images?
By default, Contributors lack the upload capability. An Editor can add images during review, or you can adjust the role with a plugin.
What happens to posts when I delete a user?
WordPress asks whether to delete their content or attribute it to another user. Always choose to attribute it unless you want it gone.
Conclusion
WordPress user roles let your team collaborate without giving everyone the keys to everything. Keep Administrators few, use Editors and Authors for content, Contributors for work that needs review, and plugin roles such as Shop Manager where relevant. Combine this with named accounts, work email and regular reviews, and your website stays both productive and secure.
If you need help setting up roles or securing a WordPress site, the Baasa Cloud support team is happy to assist.