Someone new is joining, and they need to get into the website. Perhaps it is a staff member who will post offers, a writer for the blog, or a part-time assistant who looks after the shop orders. You know they need “a login”, but the form in WordPress asks for more than you expected, and you are not sure which role to tick or whether to make up a password for them.
Below is how to add a new user in WordPress so the person can sign in on their own, with the access they need and no more. The form itself takes a couple of minutes. The thinking happens before you open it.
Three decisions to make before you open the form
Which email address. Every account needs an email that no other account on the site already uses. Use the address the person will actually read, ideally a work address on your own domain. Password reset links and security notices go there, so a mistyped or abandoned inbox causes trouble later.
Which role. This decides what they can touch. For most staff who update pages and news, Editor is enough. A blog writer fits Author; choose Contributor instead when you would like to read every post before it goes live. Only people doing technical work need Administrator. If you are unsure, our breakdown of WordPress user roles and permissions goes through each one with examples. Start lower; you can always raise it.
Which username. Of the three, this is where you have the least room to correct a mistake, because WordPress does not let you edit a username from the dashboard once the account exists. More on choosing it below.
How to add a new user in WordPress, step by step
You need to be logged in as an Administrator. Other roles do not see the option.
- In the dashboard, go to Users → Add User. Older versions call the menu item Add New User or simply Add New; it is the same screen.
- Enter the Username. Letters, numbers and a few characters such as dots, hyphens and underscores are fine. Avoid spaces to keep things simple.
- Enter the Email.
- Fill in First Name and Last Name. These are optional, but they make the Users list readable and let you choose a proper display name later. The Website field is optional and can stay empty.
- If your site has more than one language installed, you will also see a Language setting for the person’s dashboard. Leave it on the site default unless they prefer another.
- For the Password, click Generate password if one is not already filled in, and WordPress creates a strong one. Leave it as it is. You do not need to know it, because the next step lets the person set their own.
- Keep Send User Notification ticked. This emails the new user a link to choose their password.
- Pick the Role from the dropdown.
- Click the Add User button at the bottom (older versions label it Add New User). You are taken back to the user list with a confirmation message, and the new account appears in it.
On a multisite network the screen looks different and may offer to add an existing network user instead. The steps above are for a normal single site, which is what most businesses run.
What the new person receives
If you left the notification ticked, the person gets an email from your site with their username and a link to set a password. They click it, choose or accept a password, and can then log in at your site’s login page, usually your address followed by /wp-admin/.
Tell them to expect it. To a careful person, an unexpected email from “WordPress” with a login link looks a lot like phishing, and some will delete it unread. A quick message from you the same day (“you’ll get an email from our website to set your password”) avoids that.
The link does not stay valid forever. If they leave it for a while and it stops working, nothing is lost: they can use “Lost your password?” on the login page, or you can send a fresh link from the Users list. Hover over their name and choose Send password reset.
When the email never arrives
Ask them to check spam first. If it is not there, the problem is almost always your site’s outgoing email rather than the account. Many WordPress sites send mail in a way that inboxes distrust. Our post on why WordPress emails go missing covers the usual fixes. In the meantime you can open the user’s profile, click Set New Password, type a strong password and share it with them by a safe route such as a password manager, then ask them to change it after they log in.
Choosing a username you will not regret
Because a username is fixed once created, pick one that will still make sense in a few years.
- Use something tied to the person, not the job. “priya.s” stays accurate if Priya moves from marketing to sales. “marketing” does not, and it tempts people to share it.
- Do not use “admin”, “administrator” or your business name. These are the first names automated login attacks try.
- Be aware it can appear in public. WordPress builds the address of an author’s archive page from the username, so on many themes it shows in a link under their posts. Another reason to avoid anything embarrassing or revealing.
- Keep it plain. Lowercase, no spaces, no special characters beyond a dot or hyphen. It saves confusion when people type it on a phone.
If a username has already gone wrong, the workarounds are in how to change a WordPress username.
After the account is created
Three small jobs once the account exists:
- Set the display name. Open the user’s profile and choose how their name appears on posts under “Display name publicly as”. Otherwise their username may show as the author.
- Ask them to turn on two-factor login if your site uses a two-factor plugin, especially for Editors and above.
- Write it down. Keep a short note of who has an account, what role and why. It makes the next tidy-up much easier.
This is one small part of looking after a site, and the wider picture is in the complete WordPress guide for owners. For everything else about accounts, from roles to removing people, see the hub on managing WordPress users.
Mistakes that cause trouble later
- Giving Administrator “to be safe”. It feels helpful, but it lets a new person delete plugins, change settings and create other administrators. Raise the role only when a task actually needs it.
- Reusing one email for two accounts. WordPress will refuse, and people then invent throwaway addresses that nobody reads.
- Typing your own password into the form and emailing it. Let the person set their own through the link.
- Creating accounts for the public by hand. If customers or members need accounts, that is a registration setting, not something to do one by one. See the user registration settings before switching it on.
Frequently asked questions
Can an Editor add new users?
No. On a standard single site only Administrators can create accounts. Editors can manage all content but cannot see the screen for adding users. If you want a manager to add staff without giving them full control of the site, that needs a custom role with the user-creation permission, which is possible with a role editor plugin.
Can two users share the same email address?
No. WordPress requires a different email address for every account and will show an error if the address is already registered. If one person genuinely needs two accounts for testing, some email services let you add a plus sign and a word before the @ to create a variation that still lands in the same inbox.
Does adding a user notify anyone else?
The site administration email address usually receives a short notice that a new user was created, alongside the welcome email to the person themselves. It is a useful record. If you ever get one of these notices for an account you did not create, check the Users screen straight away.
Should I untick Send User Notification?
Only if you have a reason, such as creating an account you will hand over later or one for a person who already has their password set another way. Without the email, the person has no way to choose a password, so you would have to set one yourself and pass it on safely.
Welcome emails that never arrive and logins that keep failing are the sort of problem our WordPress support service deals with, and a backup is taken before any change is made.
Next in this series: How to Give a Developer Access to WordPress Safely
