Open the Users screen on most small business WordPress sites and you will find more administrators than anyone expected. The owner, the person who built the site, a freelancer who fixed a menu long ago, a staff member who left, and an account called “office” that three people share. Every one of them can install plugins, delete pages and create new administrators.
Nobody set it up that way on purpose. Each account made sense the day it was created. But each one is also a way into your site, and most of them have far more power than the person behind them needs.
The roles WordPress gives you
WordPress comes with a set of roles, and each one is a bundle of permissions. On a normal single site there are five:
- Administrator can do everything: install and delete plugins and themes, change settings, edit any content, and add, change or remove other users, including other administrators.
- Editor can publish, edit and delete any post or page, including other people’s, and manage categories and comments. Editors cannot install plugins, change themes or manage users.
- Author can write, publish and delete their own posts and upload images. They cannot touch anyone else’s posts or edit pages.
- Contributor can write and edit their own posts but cannot publish them. Someone with a higher role has to review and publish. Contributors also cannot upload files.
- Subscriber can log in and manage their own profile, and nothing else in the dashboard.
If WooCommerce is installed, it adds two more:
- Shop Manager can manage products, orders, coupons and WooCommerce settings, and edit content, but does not get the administrator’s control over plugins, themes and users.
- Customer is what people get when they create an account at checkout. It works much like Subscriber, with access to their orders and account details on the front of the site.
Some plugins add roles of their own, such as an SEO manager, which appear in the role dropdown.
Least privilege, in plain terms
The idea is simple: give each person the lowest role that lets them do their job, and nothing more. If an account with limited power has its password stolen, the damage is limited too. An Author account that gets taken over can deface that author’s posts. An Administrator account that gets taken over can hand the whole site to someone else.
It also protects you from honest mistakes. Someone who only writes blog posts cannot accidentally deactivate the plugin that runs your contact form if they never had the power to do it.
For a typical small business, it usually works out like this:
- The owner keeps one Administrator account. This is the account you use for settings and users, not for writing a quick post.
- Staff who update pages, news and offers are Editors. That covers almost all day-to-day content work.
- A staff member or guest who writes blog posts is an Author, or a Contributor if you want to approve each post first.
- The person who handles orders on a WooCommerce store is a Shop Manager, not an Administrator.
- A freelancer or agency doing technical work often does need Administrator access, because updates and plugin work require it. Give them their own named account, and remove or downgrade it when the job ends.
One detail worth knowing: on a standard single site, Editors as well as Administrators can add raw HTML, including scripts, to posts and pages. That is useful for embedding things, but it means an Editor account is more powerful than it looks. Treat it with the same care.
Shared logins are the hidden problem
A single login used by several people feels convenient. It causes problems you only notice later.
- You cannot tell who did what. If a page is deleted or a setting changes, the activity log, if you have one, just shows the shared account.
- You cannot remove one person. When someone leaves, the only way to cut off their access is to change the password and tell everyone else the new one. In practice this often does not happen.
- Two-factor authentication stops working well. The codes come to one phone, so either everyone has to ask one person for a code, or two-factor gets switched off. Our guide to setting up WordPress two-factor authentication assumes each person has their own account for exactly this reason.
- The password travels. It ends up in a WhatsApp group, an email thread or a sticky note, which is exactly where you do not want it.
WordPress accounts cost nothing. Give everyone their own, with their own email address and their own password.
Removing old accounts
Accounts that nobody uses are the most dangerous ones, because nobody notices when they are misused. A former employee’s account with a weak password, or a developer account from a past project, is the kind of thing brute-force login attacks are looking for.
When you delete a user, WordPress asks what to do with any content they created. Choose to attribute it to another user, usually the owner or a current editor, unless you really do want their posts gone. Deleting the content by mistake is the usual way this step goes wrong.
If you are not ready to delete an account, for example because someone may come back, change their role to Subscriber and reset their password. They keep nothing they can damage.
The same applies when you change who looks after your site. If a previous developer or agency set it up, their administrator accounts may still be there. Our notes on taking over a website from another developer cover the other access to check at the same time, such as hosting, domain and email.
How to audit your user list
This takes about as long as a cup of tea on a small site. Go to Users in the dashboard and work through it:
- Filter by Administrator. The links above the user list let you show one role at a time. For each administrator, ask who it is and whether they still need that level. Many small sites only need one.
- Look for accounts you do not recognise. An administrator you did not create is a warning sign, not a tidying job. Do not just delete it. Treat the site as possibly compromised and follow how to fix a hacked WordPress website.
- Check the email addresses. Every account should use an address the person still controls. An account tied to an old employee’s mailbox, or to a free address nobody checks, cannot receive password resets or security notices.
- Downgrade before you delete. Where someone has more power than they need, change their role. You can do this from the user’s profile, or select several users and use the “Change role to” option.
- Check Application Passwords. On each user’s profile there is a section for application passwords, which let other software log in as that user. Revoke any that nobody can explain.
- Check two settings under Settings, then General. “Anyone can register” should be off unless you run a membership site or a store with customer accounts. “New User Default Role” should be Subscriber, or Customer on a WooCommerce store. If it is set to anything higher, change it now.
WordPress does not show when each user last logged in, so if you want that information, a security or activity-log plugin can record it. That makes the next audit much quicker.
Make it a habit
Roles drift. Someone gets promoted to Administrator “just for today” and stays there for a year. A good rhythm is to check the user list every few months, and always on three occasions: when someone leaves, when a freelancer or agency finishes a job, and when you change who maintains the site.
Pair it with the basics from the rest of this series: long, unique passwords, login attempt limits and two-factor authentication on every account that can change the site. Together they close most of the ways an attacker gets in through the front door.
If you would like someone to go through this for you, our website security audit and hardening starts from ₹1,999 onwards. It looks at user accounts and roles alongside the rest of your site’s weak points, and you get a clear list of what we found before anything is changed.
Choosing roles is one part of the job; managing WordPress users covers adding, changing and removing accounts as people come and go.
Next in this series: WordPress File Permissions Explained: 755, 644 and 777
