A role defines what a user is allowed to do on your WordPress site. Rather than giving every logged-in user the exact same access, roles let you control permissions based on what each person actually needs to do.
The Default WordPress Roles
- Administrator — full control over the entire site.
- Editor — can manage and publish all posts, including those by other users.
- Author — can publish and manage their own posts only.
- Contributor — can write posts but needs approval before they’re published.
- Subscriber — can only manage their own profile, typically used for commenters or members.
Why Roles Matter for Security
Giving everyone Administrator access might seem convenient, but it’s risky — a single compromised account could mean full control of your site. Assigning the least amount of access someone actually needs is a much safer default.