{"id":30199,"date":"2026-01-06T09:14:00","date_gmt":"2026-01-06T08:14:00","guid":{"rendered":"https:\/\/www.web-systems.pl\/wordpress-user-roles-who-gets-dashboard-access\/"},"modified":"2026-10-13T14:55:58","modified_gmt":"2026-10-13T13:55:58","slug":"wordpress-user-roles-who-gets-dashboard-access","status":"publish","type":"post","link":"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/","title":{"rendered":"WordPress user roles: who in the company gets access to the dashboard"},"content":{"rendered":"\n<p class=\"wp-block-paragraph\">WordPress user roles decide what a given person can do in the site dashboard. Full access should go only to the people who are responsible for the whole website. The rest of the team? As much as their work requires, and not one click more.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If there are several administrator accounts sitting in the dashboard and nobody remembers who created them, it is time to tidy up. Below you will find the differences between the roles, a hint on who to assign where, a way to give an agency safe access and an account audit checklist.<\/p>\n\n\n\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_86 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<div class=\"ez-toc-title-container\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of contents<\/p>\n<span class=\"ez-toc-title-toggle\"><\/span><\/div>\n<nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#Which_WordPress_user_roles_are_available_and_what_are_they_responsible_for\" >Which WordPress user roles are available and what are they responsible for?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#Editor_vs_Author_in_WordPress_which_team_member_to_assign_to_which_role\" >Editor vs Author in WordPress: which team member to assign to which role<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#How_many_WordPress_administrator_accounts_does_a_company_really_need\" >How many WordPress administrator accounts does a company really need?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#Dashboard_access_for_agencies_and_freelancers_how_to_grant_it_safely\" >Dashboard access for agencies and freelancers: how to grant it safely<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#Checklist_a_user_role_audit_in_the_dashboard_step_by_step\" >Checklist: a user role audit in the dashboard step by step<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#What_to_do_with_an_administrator_account_nobody_recognizes\" >What to do with an administrator account nobody recognizes?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#Frequently_asked_questions\" >Frequently asked questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#What_is_the_difference_between_the_Editor_role_and_the_Author_role_in_WordPress\" >What is the difference between the Editor role and the Author role in WordPress?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#Can_I_delete_an_administrator_account_created_by_the_previous_agency\" >Can I delete an administrator account created by the previous agency?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.web-systems.pl\/en\/wordpress-user-roles-who-gets-dashboard-access\/#Which_role_should_I_give_an_agency_that_runs_the_company_blog\" >Which role should I give an agency that runs the company blog?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Which_WordPress_user_roles_are_available_and_what_are_they_responsible_for\"><\/span>Which WordPress user roles are available and what are they responsible for?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">WordPress has the built-in roles Administrator, Editor, Author, Contributor and Subscriber, and in a Multisite network there is also Super Admin. Each role is a set of <strong>capabilities<\/strong>, meaning specific actions the system allows: publishing posts, moderating comments, editing other users. And here is a small trap. According to the <a href=\"https:\/\/wordpress.org\/documentation\/article\/roles-and-capabilities\/\" rel=\"nofollow noopener\" target=\"_blank\">WordPress roles and capabilities documentation<\/a>, this is not a ladder of seniority. Roles describe the scope of responsibility, not who is more important in the company.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Administrator<\/strong> manages the whole single site: plugins, themes and accounts.<\/li>\n<li><strong>Editor<\/strong> handles the content of all authors.<\/li>\n<li><strong>Author<\/strong> publishes and edits their own posts.<\/li>\n<li><strong>Contributor<\/strong> writes texts but cannot publish them on their own.<\/li>\n<li><strong>Subscriber<\/strong> can only read.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Super Admin appears only in WordPress Multisite and covers the whole network of sites. On an ordinary company website there is nobody above the Administrator.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Editor_vs_Author_in_WordPress_which_team_member_to_assign_to_which_role\"><\/span>Editor vs Author in WordPress: which team member to assign to which role<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Whoever coordinates other people&#8217;s content gets the Editor role. Whoever publishes only their own texts gets Author. And an external copywriter with no right to publish? Contributor. In practice it looks like this: the content manager or head of marketing works as an Editor, the blog specialist as an Author, and a freelancer whose texts someone has to approve as a Contributor.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Nobody in marketing needs admin to write posts. Nobody. Full access means installing plugins and changing the theme, so a single mistake can take the site down (and it usually happens on a Friday afternoon). Before you hand out accounts, plan <a href=\"https:\/\/www.web-systems.pl\/en\/wordpress-woocommerce-training\/\">WordPress training for your team<\/a>, so that everyone knows what their role actually does in the dashboard.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_many_WordPress_administrator_accounts_does_a_company_really_need\"><\/span>How many WordPress administrator accounts does a company really need?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">As many as there are people responsible for the technical maintenance of the site. Usually that is the owner and the company that services the site. An Administrator manages plugins, themes and other users, so every unnecessary account with this role is a wider attack surface. The WordPress documentation says it plainly: grant only the permissions required by the tasks that are actually performed. Oh, and everyone gets their own named account. Shared logins such as &#8220;admin&#8221; or &#8220;office&#8221; mean that later you cannot work out who changed what. The next steps, that is <a href=\"https:\/\/www.web-systems.pl\/en\/wordpress-security-hardening-protect-your-site-from-attacks\/\">securing the WordPress dashboard<\/a>, I describe in a separate guide, and you will find the technical details in the <a href=\"https:\/\/developer.wordpress.org\/advanced-administration\/security\/hardening\/\" rel=\"nofollow noopener\" target=\"_blank\">official WordPress hardening guide<\/a>.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Dashboard_access_for_agencies_and_freelancers_how_to_grant_it_safely\"><\/span>Dashboard access for agencies and freelancers: how to grant it safely<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An agency gets a separate named account, with the lowest role that is enough for the task, and with a date after which the account will be removed or downgraded. A content team will manage perfectly well as Editor or Author. Full access? Only for the company that updates plugins and services the site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Enter every such account in a simple register: who, which role, what for and until when. Nothing big, just a plain table. But it is exactly what closes the subject of accounts everyone has forgotten about. The same rule works in other tools, for example when <a href=\"https:\/\/www.web-systems.pl\/en\/how-to-safely-grant-access-to-google-merchant-center\/\">granting access in Merchant Center<\/a>. And if nobody in the company keeps an eye on accounts, consider IT support without your own department.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Checklist_a_user_role_audit_in_the_dashboard_step_by_step\"><\/span>Checklist: a user role audit in the dashboard step by step<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">An audit means going through every account, assigning it to a specific person and leaving that person only the role they really need.<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Go to Users, turn on the Administrator filter and write down all the accounts.<\/li>\n<li>For each one, establish the owner and the reason for access.<\/li>\n<li>Delete the accounts of people who have left and assign their content to someone else.<\/li>\n<li>Downgrade roles wherever full access is unnecessary.<\/li>\n<li>Change the passwords of the accounts that stay.<\/li>\n<li>In Settings &gt; General, set the default role for new users to Subscriber.<\/li>\n<li>Save the result in the access register and repeat the review regularly.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">When you delete an account, WordPress will ask who should take over its content. Point to an existing user and that is it, the posts will not disappear along with the account.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_to_do_with_an_administrator_account_nobody_recognizes\"><\/span>What to do with an administrator account nobody recognizes?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">First check whether it was created by the former contractor who built the site. Nobody owns up? Then treat it as a possible trace of a break-in. Note down the login and e-mail address, ask the previous agency and the hosting provider, and only then delete the account and change the passwords of the remaining administrators. And one more thing: an unknown account with full permissions is a signal to review the plugins and the files on the server, because an intruder may have left a backdoor there. An action plan for the moment <a href=\"https:\/\/www.web-systems.pl\/en\/hacked-wordpress-the-first-two-hours\/\">when WordPress gets hacked<\/a> will help you set the order of the steps.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Well-configured WordPress user roles come down to three rules: one named account per person, the lowest role that is enough for the job, and a regular review. Today, go through the list of administrators. Tomorrow, set up an access register so that new accounts do not spring up without the owner knowing.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1790308456216-0\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"What_is_the_difference_between_the_Editor_role_and_the_Author_role_in_WordPress\"><\/span>What is the difference between the Editor role and the Author role in WordPress?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>An Editor manages the content of all users: they can edit, publish and delete it. An Author publishes and edits only their own posts. The first role suits a content coordinator, the second a person who writes the blog.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1790308456216-1\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"Can_I_delete_an_administrator_account_created_by_the_previous_agency\"><\/span>Can I delete an administrator account created by the previous agency?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Yes, but first assign its content to another user. Also check whether the account is used by some integration or by the current company maintaining the site. After deleting it, change the passwords of the remaining administrators.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1790308456216-2\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><span class=\"ez-toc-section\" id=\"Which_role_should_I_give_an_agency_that_runs_the_company_blog\"><\/span>Which role should I give an agency that runs the company blog?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Editor or Author on a separate, named account is enough. Administrator is needed only when the agency does technical work, for example updates plugins. Enter the account in the access register together with the review date.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>WordPress user roles decide what a given person can do in the site dashboard. Full access should go only to the people who are responsible for the whole website. The rest of the team? As much as their work requires, and not one click more. If there are several administrator accounts sitting in the dashboard [&hellip;]<\/p>\n","protected":false},"author":9,"featured_media":30159,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[828,838],"tags":[2235,1081,2242,901,2238,1192],"class_list":["post-30199","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-wordpress-en","tag-admin-panel","tag-how-to","tag-permissions","tag-security","tag-user-roles","tag-wordpress-en"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30199","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/comments?post=30199"}],"version-history":[{"count":3,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30199\/revisions"}],"predecessor-version":[{"id":30248,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/posts\/30199\/revisions\/30248"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/media\/30159"}],"wp:attachment":[{"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/media?parent=30199"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/categories?post=30199"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.web-systems.pl\/en\/wp-json\/wp\/v2\/tags?post=30199"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}