Every WordPress login is a potential way in. A hijacked Administrator account can install plugins, which means running code on your server, while a hijacked Author can only mess with their own posts. Giving each person the lowest role that lets them do their job, plus a few account-security basics, limits the damage of a stolen password considerably.

Default roles

Role Can do Typical use
Administrator Everything: plugins, themes, users, settings, code (unless disabled) Site owners, developers
Editor Publish and manage all posts and pages, moderate comments Content managers
Author Write, publish and edit their own posts, upload media Regular writers
Contributor Write and edit their own posts, but not publish or upload Guest writers
Subscriber Manage their own profile Members, commenters, customers
Super Admin (multisite) Network-wide administration Network owner

Plugins add roles. WooCommerce adds Shop Manager (manage orders, products and customers without full admin rights) and Customer.

Apply least privilege

  • Very few Administrators, ideally one or two people who need to manage plugins and settings.
  • Content teams: Editor or Author. They don’t need plugin access.
  • Store staff: Shop Manager, not Administrator.
  • Agencies and freelancers: a temporary Administrator account that you remove when the work is done, not a shared login.
  • No shared accounts. Every person gets their own login, so actions are attributable and access can be revoked individually.

Audit users with WP-CLI

wp user list --fields=ID,user_login,user_email,roles,user_registered
wp user list --role=administrator

Change a role:

wp user set-role alice editor

Remove a user, reassigning their content:

wp user delete olduser --reassign=1

Look for unknown administrators. Attackers often add one, so an unexpected admin account is a red flag. See WordPress malware removal and WP-CLI.

Registration settings

If you don’t need public sign-ups, keep Settings → General → Membership: “Anyone can register” unchecked. If you do (membership sites, shops), make sure New User Default Role is Subscriber (or Customer), never higher. Attackers try to register accounts on sites where the default role was mistakenly set to Editor or Administrator.

Capabilities and custom roles

Roles are bundles of capabilities, such as edit_posts, publish_posts, manage_options and install_plugins. You can create custom roles for specific needs, e.g. an “SEO Manager” who can edit posts and access the SEO plugin’s settings but not install plugins:

wp role create seo_manager "SEO Manager" --clone=editor
wp cap add seo_manager wpseo_manage_options
wp cap list seo_manager

In code (in a small custom plugin):

add_role('support_agent', 'Support Agent', [
  'read' => true,
  'edit_shop_orders' => true,
  'read_shop_order' => true,
]);

Plugins like Members or User Role Editor provide a UI for this. Remove custom roles you no longer use.

Secure the accounts themselves

  • Strong, unique passwords in a password manager. See team password managers.
  • Two-factor authentication for every account with Editor rights or above (Two-Factor, Wordfence or other plugins).
  • Limit login attempts and block brute force at the server. See Fail2Ban for WordPress.
  • No “admin” username. Change it by creating a new admin and deleting the old one with --reassign.
  • Disable file editing in the dashboard, so even an Administrator session can’t edit PHP:
define('DISALLOW_FILE_EDIT', true);
  • Review application passwords (Users → Profile), which grant API access, and revoke unused ones.

Offboarding checklist

When someone leaves:

  1. Change their role to Subscriber, or delete the user, reassigning their content.
  2. Revoke their application passwords and active sessions (wp user session destroy USER --all).
  3. Rotate shared secrets they knew: hosting, SFTP and API keys.
  4. Remove their SSH keys from the server, if they had server access. See least privilege.

Quick reference

Task Command
List users wp user list
List admins wp user list --role=administrator
Change role wp user set-role USER ROLE
Delete, reassign content wp user delete USER --reassign=ID
Create custom role wp role create SLUG "Name" --clone=editor
Add capability wp cap add ROLE CAPABILITY
Kill sessions wp user session destroy USER --all

Related: WordPress hardening and WordPress multisite.

  • WordPress
  • Security
  • Users