WordPress User Roles Explained: Who Should Get Which Access

WordPress has six standard user roles: Super Admin (multisite only), Administrator, Editor, Author, Contributor and Subscriber. Each is a bundle of permissions that decides who can publish, edit, install plugins or change settings. Give people the lowest role that lets them do their job, and you cut the risk of accidents and security problems on your site.

This guide walks through each role, the difference between roles and capabilities, how to change a role, when custom roles make sense, and how Elementor’s own permissions sit on top of all this. We build and maintain WordPress sites for UK businesses, so we have added the practical calls we make for clients.

TL;DR

• WordPress ships with Administrator, Editor, Author, Contributor and Subscriber, plus Super Admin on multisite networks.
• A role is a bundle of capabilities. Capabilities are the individual actions, such as publishing posts or deleting users.
• Only Administrators can change other users’ roles, from the Users screen.
• Most small business sites need one or two Administrators and everyone else on Editor, Author or Contributor.
• If you use Elementor, it has its own Role Manager, so check both layers when you grant access.

Table of Contents

• The default WordPress user roles
• Roles versus capabilities
• Editor vs Administrator: where the line sits
• How to change a user’s role
• When custom roles make sense
• Elementor, the block editor and permissions
• A sensible setup for a small UK business
• Our perspective
• Need a hand with your WordPress setup?
• FAQ
• Sources

The default WordPress user roles

According to the WordPress roles and capabilities documentation, the default roles run from full network-wide control (Super Admin) and single-site administration (Administrator) down to basic read-only access (Subscriber). Here is how that plays out day to day.

The role descriptions above follow the same official documentation. Let’s look at each one in the way a business owner would think about it.

Administrator

An Administrator can do everything on a single site. That means installing plugins, changing themes, adding users and editing settings. It also means they can break the site or lock you out.

Keep this role for the owner and one trusted technical person. If your web agency needs access, give them an Administrator account under their own name, not a shared login, and remove it when the project ends.

Editor

An Editor can publish and manage posts, including other users’ posts. They run the content side of your site without touching plugins, themes or site settings. For a marketing manager or office manager updating news and service pages, this is usually the right fit.

Author

An Author manages their own posts. They can publish what they write, but they cannot change what a colleague wrote. It suits a team where several people each own a set of articles, such as a solicitor’s practice where each partner writes on their own specialism.

Contributor

A Contributor can write and manage their own posts but cannot publish them. Someone with a higher role reviews and publishes. This is the safest way to bring in freelancers or junior staff, because nothing goes live without a second pair of eyes.

Subscriber

A Subscriber can only manage their own profile. You will see this role on sites with a login area, such as client portals or member areas. If your site has open registration, check what the default role for new sign-ups is. It should be Subscriber, not anything higher.

Super Admin

Super Admin appears only on WordPress Multisite, where one installation runs a network of sites. Most single-business websites never see it. If you are not running a network, you can ignore it.

Roles versus capabilities

This is the idea that makes everything else click. Capabilities are the individual actions a user can perform, such as publish_posts or delete_users. Roles are predefined collections of those capabilities assigned to users, as the official roles and capabilities page explains.

When someone tries to do something, WordPress checks the capability against the user’s role. The Learn WordPress tutorial on developing with roles and capabilities describes this check, which developers run using current_user_can.

Why does it matter to you? Because a plugin’s menu may be hidden or visible based on a single capability, not on the role name. If an Editor cannot see a screen you expected, a missing capability is the likely reason, and that is a conversation for your developer rather than a reason to promote them to Administrator.

Editor vs Administrator: where the line sits

This is the comparison business owners ask about most. The short version:

• Editor: looks after content. Can publish and manage posts, including those written by others.
• Administrator: looks after the whole site. Has access to every administration feature on that site.

If you are deciding for a specific person, ask one question: do they need to change how the site works, or only what it says? If the answer is “what it says”, Editor is enough. Handing out Administrator access to save a bit of time is how an old plugin gets installed by someone who meant well, and how a site ends up needing a repair.

There is a content-privacy side too. Other editors and administrators can view or modify private posts, so the WordPress guidance on content visibility says to be careful about what you put in private posts on multi-user sites. Do not treat “private” as “secret from the team”.

How to change a user’s role

Only an Administrator can do this. The WordPress Users screen documentation describes the route:

1. Log in to your dashboard as an Administrator.
2. Go to Users and tick the box next to one or more users.
3. Pick the new role from the Change role to dropdown.
4. Click Change.

You can also open an individual profile and change the role there. Two habits are worth building in.

• Review roles every quarter. Former staff, past freelancers and old agency logins are the accounts most often forgotten.
• Demote before you delete. If someone leaves, move them to Subscriber first, check nothing breaks, then remove the account. Before deleting, reassign their content so it is not lost.

When custom roles make sense

The five standard roles cover most small sites. Custom roles earn their place when your team has a job the defaults do not match. Examples we see in UK businesses:

• A shop manager who should handle orders and products but never touch plugins.
• A reviewer who can read drafts and leave comments but not edit them.
• A “site editor” who can change page content and menus but not install code.

The WordPress documentation shows that custom roles can be created with the add_role function in PHP, and that capabilities can be added or removed with add_cap and remove_cap, with a Site Editor role as its worked example. Both are covered in the roles and capabilities documentation.

A few rules keep this safe:

1. Start from the nearest default. Copy Editor or Author and remove what is not needed, rather than building up from nothing.
2. Be careful with unfiltered_html. This capability lets a user add raw code. From WordPress 7.0, the Custom HTML block shows its CSS and JavaScript panels only to users who have it, which tells you how seriously the platform treats it.
3. Test on a staging copy. Log in as a test user with the new role and try the tasks it should and should not allow. Our guide to safe WordPress updates on staging covers how to set that up without risking the live site.
4. Write down who has what. A simple list of names, roles and reasons saves hours when someone leaves.

You can do this with a plugin or with a few lines of code. Either way, keep it small. A handful of well-named roles is easier to maintain than a dozen one-offs.

Elementor, the block editor and permissions

Many readers arrive at roles because they are comparing Elementor with the block editor and wondering who can edit what. Here is the plain picture.

What each editor is

The block editor, often called Gutenberg, is WordPress’s default editor. The WordPress documentation on the block editor says it builds posts and pages from blocks such as paragraphs, images, headings, videos and galleries. Elementor is a plugin with a live drag-and-drop canvas and more extensive visual and responsive controls. According to Hostinger UK’s comparison, it has a free core and paid advanced features, while Gutenberg is included with WordPress. Gutenberg users generally work within the theme’s design system.

Which should you pick?

On page weight, the same Hostinger UK piece describes Gutenberg as lighter with leaner code and Elementor pages as heavier, and recommends optimising Elementor sites and using strong hosting or a CDN. Elementor itself says that using containers can reduce dividers and DOM load, so build choices matter as much as the tool.

The block editor has also moved on. WordPress 6.3 brought content, templates and patterns together in the Site Editor, and shipped 170+ performance updates. If you last looked at it years ago, it is worth another look.

Our view: neither is automatically better. If your team mostly writes and updates content and you want speed and simplicity, the block editor is a sound base. If you want precise visual control on landing pages and have a designer to look after it, Elementor can be a good fit. What matters is a clear design system behind either choice.

Block themes versus classic themes

This choice sits underneath the editor question. A classic theme uses PHP templates and the Customizer, while a block theme uses block-based templates you can edit in the Site Editor. Our practical advice: if you are building new, a block theme gives you more editing control without extra plugins. If you have a working classic theme that your business relies on, there is rarely a reason to rebuild purely for fashion. Move when you have a design or performance reason.

Elementor has its own permission layer

This is the part many owners miss. The Elementor Role Manager lets administrators limit Elementor access, for example no access to the editor, or edit contents only, independently of standard WordPress roles. So a user can be an Editor in WordPress and still be locked out of Elementor’s design controls.

Elementor also cautions that granting permissions for JSON file uploads or HTML widgets can introduce malware risks. Treat those two options as Administrator-level trust. A content editor needs to change words and images, not upload code.

A sensible setup for a small UK business

Here is a pattern that works for a typical ten-person company with a marketing lead, a couple of writers and an outside agency.

Then add the housekeeping that keeps it safe:

• Use unique logins and strong passwords for everyone, never shared accounts.
• Turn on two-factor authentication for Administrators and Editors.
• Keep updates current. Our article on website maintenance explains why neglected sites are the ones that get into trouble.
• Audit users every quarter and remove anyone who has moved on.

If you want a view of what ongoing care typically costs, we have published agency-validated maintenance price bands for UK SMEs.

Our perspective

We have built and looked after WordPress sites for small and growing businesses for over a decade, and the same pattern turns up again and again. Trouble rarely starts with a hacker. It starts with a well-meaning person who had more access than their job needed.

So we begin every build by asking who will update what, and we set roles to match before the site goes live. We would rather spend twenty minutes on a roles plan at the start than a day cleaning up afterwards. When a client wants more freedom for their team, we prefer a small custom role over promoting someone to Administrator.

The same thinking applies to the editor choice. We like a design system that lets your team change content confidently without breaking the layout, whether that is built with blocks or with Elementor. Our approach combines creative design and technical delivery in one team, with a collaborative process and unlimited revisions on branding and web system work, so the permissions, the look and the build all agree with each other.

— Kukoo

Need a hand with your WordPress setup?

If your site has grown a tangle of old logins, or you are unsure whether it is fast and safe enough, we can help. Our £25 website speed improvement is a low-cost way to find out what is slowing you down, and our ongoing website care plans (Fix, Steady, Secure and Scale) cover updates, security and support. For a new build or redesign, see our web design and development services.

FAQ

What is the difference between a user and an admin in WordPress?

A user is anyone with an account, and their role decides what they can do. An admin, short for Administrator, has access to all administration features on a single site. Other roles such as Editor, Author, Contributor and Subscriber have progressively fewer permissions.

How do I change a user’s role in WordPress?

Log in as an Administrator and go to Users. Tick the user, choose a new role from the Change role to dropdown and click Change. You can also edit the role from the individual user’s profile.

Can I create my own custom user role?

Yes. Developers can use the add_role function to create a role and add_cap or remove_cap to adjust its capabilities, or you can use a role-management plugin. Start from the closest default role and test it on a staging copy before using it on the live site.

Does Elementor replace WordPress user roles?

No. Elementor’s Role Manager adds a second layer of limits, such as no access to the editor or edit contents only. A user still has a standard WordPress role, so you need to check both when granting access.

Sources

• Roles and Capabilities, WordPress documentation
• Developing with user roles and capabilities, Learn WordPress
• Set blog content visibility, WordPress documentation
• Users screen, WordPress documentation
• Custom HTML block, WordPress documentation
• WordPress Block Editor, WordPress documentation
• Elementor vs WordPress, Hostinger UK
• Improve your page performance, Elementor Help
• WordPress 6.3 release notes
• Control user permissions with Role Manager, Elementor Help

Recommended

• Staging, Test, Promote: Safe WordPress Security Updates for UK Sites