Most owners only open the Users screen when something forces them to. A new hire needs to update the blog, a freelancer asks for a login, or someone leaves and you realise you have no idea what they could still do. You click Users and find a list of names, half of which you would struggle to explain.
It is easier to manage WordPress users as a small, regular habit than as a clean-up after something has gone wrong. What follows is the overview: who should have an account at all, how roles fit in, how people join and leave, how passwords and outside access work, and which post in this section has the step-by-step detail for each job.
What the Users screen is telling you
Go to Users → All Users. Each row shows the username, the person’s name, their email address, their role and how many posts they have written. Above the table is a row of links such as “All”, “Administrator” and “Editor”, each with a number in brackets. Those links filter the list by role, and the numbers are the quickest health check you have: if the Administrator count is higher than the number of people you trust with the whole site, start there.
Hover over a row and you get the actions: Edit, Delete, View (for people with posts), and on recent versions a “Send password reset” link. Your own account appears too, but WordPress will not let you delete yourself from this list.
Your own details live under Users → Profile. Everyone with an account has a Profile screen, even the lowest roles, and that is where they change their own password, email address and display name.
Who should have an account
A simple rule works for almost every small business: one person, one account, in their own name, with an email address they will still read next year. That rules out a few common habits.
- No shared “office” or “admin” login. When several people use one account you lose any record of who changed what, and you cannot remove one person without disturbing everyone.
- No accounts “just in case”. An account nobody uses is one nobody watches. If a person does not need to log in this month, they probably do not need an account.
- No personal Gmail for business roles where you can avoid it. A work address you control means password resets reach someone you can still contact after they move on.
- Visitors and customers are a separate question. If your site lets the public register, or you run a shop with customer accounts, those users will appear in the list as well. Whether that should be switched on is covered in the post on who can register on your site.
Accounts are the people side of the wider WordPress management guide, which covers settings, updates and content as well.
Roles in one paragraph
Each account carries one role, and the role sets the limits. A standard site offers five of them. Administrator covers everything, including plugins, settings and other people’s accounts; Editor handles all posts and pages, whoever wrote them; Author is limited to their own posts; Contributor drafts posts that someone else publishes; Subscriber can only edit their own profile. WooCommerce and some other plugins add more. Match each person to the least powerful role that still covers their work. The full breakdown, with examples for a small team, is in our guide to what each WordPress role can do. If none of the standard roles fits, for instance you want staff to edit pages but not delete them, you can build your own with a custom user role.
How to manage WordPress users through their whole life on the site
Think of each account as having a start, a middle and an end. The end is the part owners tend to forget.
Joining
New accounts are made from Users → Add User (labelled “Add New User” or “Add New” on some versions). You choose a username, enter an email address, pick a role and decide whether WordPress should email the person a link to set their own password. The username is permanent from the dashboard, so it is worth a moment’s thought. The walkthrough on adding a new user in WordPress covers each field and what to send the person afterwards.
Changing
People’s jobs change, and their accounts should follow. Promote or demote by editing the user and choosing a new role, or tick several users in the list and use the “Change role to…” dropdown above the table. A role change takes effect the next time WordPress checks their permissions, so you do not need to log them out.
Other changes are less obvious. Someone marries and wants a new surname shown on their posts; that is the display name, not the username. Someone changes email; the profile asks them to confirm the new address before it switches. And the username itself cannot be edited in WordPress at all, which surprises people. There are workarounds, and a separate post in this section on changing a WordPress username explains them.
Leaving
When a person no longer needs access, you have two choices: delete the account, or keep it and take its power away. Deleting brings up a screen asking what to do with their posts and pages, and choosing wrongly there is how content disappears. Read how to delete a user without losing their posts before you press the button the first time.
The WordPress account is rarely the only thing a departing employee had. Hosting, email, analytics and form notifications all need checking, and there is a checklist for that in removing access when someone leaves.
Passwords and logins
Each person is responsible for their own password, but you are responsible for the rules. A few that matter:
- Use the password WordPress generates, or one from a password manager. The strength meter on the profile screen is a useful nudge, nothing more.
- Ask for a second login step, a code from a phone app, on any account above Author level. WordPress needs a plugin for this; our post on setting up two-factor login compares the options.
- Know how to get someone back in. When a person forgets their password, there is a self-service route, an admin route and, as a last resort, a hosting route. All three are in the guide to resetting a WordPress password.
There is also a second kind of password most owners never notice. Application passwords let software such as an automation tool or a mobile app connect to the site as a user, without the normal login form. They are listed at the bottom of each profile, and anything you do not recognise there deserves a look. The post on WordPress application passwords explains when they are useful and how to revoke them.
Access for people outside the business
Developers, designers, SEO consultants and support companies all need to get in at some point. The safe pattern is always the same: they get their own account, with only the role the job needs, for only as long as the job lasts. Never hand over your own login, even for ten minutes. The guide to giving a developer access to WordPress covers the role to choose, temporary login links, and hosting access, which is a separate matter from the dashboard.
If you inherited the site from a previous developer, their accounts may still be sitting there. Treat them the same as any other leaver.
Warning signs to act on
On most sites the user list barely changes from one month to the next. These are the things that should make you stop and look properly:
- An administrator nobody can explain. Do not just delete it; it may be a sign of a break-in. Our post on an unknown admin user in WordPress explains what to record first.
- Your own account demoted or its email changed without you doing it.
- A sudden run of new Subscriber accounts with random names, which usually means registration is open and bots have found it.
- A password reset email you did not request. One is usually someone mistyping a username. Several in a row is worth noting.
On a site with several editors, an activity log plugin can show who changed what and when. Plenty of small sites manage without one; it has its own post in this section if you are weighing it up.
Frequently asked questions
How many administrators should a small business website have?
Usually two at most: the owner, and possibly the person or company who maintains the site. Having a second trusted administrator means someone can help if the owner gets locked out, but every extra administrator beyond that is another account that can change everything, so keep the number small and named.
Can I see when a user last logged in?
Not with WordPress on its own. The Users screen shows names, emails, roles and post counts, but no login history. If you need that information, an activity log or security plugin can start recording logins from the day you install it. It cannot show anything from before that point.
Is it safe to give my web designer my own login just once?
It is better not to. Anything they do will look as if you did it, shutting them out later means changing your own password, and the password often ends up saved in their browser. Creating a separate account takes a minute and can be deleted the moment the work is done.
What happens to a user’s posts if I change their role to Subscriber?
Nothing. Their posts and pages stay published and still show them as the author. A Subscriber simply cannot edit anything, including their own old posts, so changing the role is a safe way to remove someone’s power while you decide whether to delete the account later.
You can use this section as your own checklist a couple of times a year, and many owners do exactly that. If you would rather hand the routine side of the site to someone else, our WordPress maintenance plans cover safe updates, backups and keeping an eye on security.
All guides in this section
- How to Add a New User in WordPress, Step by Step
- How to Give a Developer Access to WordPress Safely
- Delete a User in WordPress Without Losing Their Posts
- Forgot It? How to Reset Your WordPress Password
- How to Change Your WordPress Username When It’s Locked
- WordPress Application Passwords: What They Are For
- How to Create a Custom User Role in WordPress
- How to Log Out All Sessions in WordPress
- WordPress User Registration Settings: Keep Them Off?
- See Who Changed What in WordPress: Logs for Staff
- WordPress Author Bio: Name, Photo and Profile Box
- Customize the WordPress Login Page With Your Logo
- How to Change a User’s Email in WordPress
- Remove Access When an Employee Leaves: Website Checklist
Next in this series: How to Add a New User in WordPress, Step by Step
