Users & Roles

WordPress Fundamentals

Chapter 8 · Users & Roles

WordPress Fundamentals 3's own "Pending Review" status was left unexplained — a status that only makes sense once more than one kind of user exists. This chapter introduces exactly that: the role system controlling who can do what on a WordPress site, presented here purely as dashboard behavior. WordPress Intermediate/Advanced 8 revisits every one of these same roles and shows they have real, enforceable teeth in actual PHP code, not just a label in a dropdown.

Why Roles Exist

Any site with more than one person touching content needs different levels of trust — a guest writer shouldn't be able to change site-wide settings, and a content manager shouldn't necessarily be able to create new user accounts. WordPress solves this with five built-in roles, each bundling together a different set of permissions.

The Five Default Roles

Role	Can do
Administrator	Everything — install plugins/themes, manage all users, change site settings; the role WordPress Fundamentals 2's own install wizard creates automatically
Editor	Publish and manage every post on the site (their own and everyone else's), manage categories/tags, moderate comments — but no plugins, themes, users, or settings
Author	Publish and manage only their own posts — no access to other users' content
Contributor	Write and edit their own posts, but cannot publish them directly — submitted content sits in the "Pending Review" status from WordPress Fundamentals 3 until an Editor or Administrator approves it
Subscriber	Manage only their own profile — no content creation ability at all; relevant for membership sites or comment systems requiring an account

The direct callback to WordPress Fundamentals 3

"Pending Review" only exists to serve the Contributor role specifically — every other role either can publish directly (Administrator, Editor, Author) or can't create content at all (Subscriber). One role, one status, purpose-built for each other.

Roles Are Really Just Named Bundles of Capabilities

Underneath the role names, WordPress actually checks individual, granular capabilities — publish_posts, edit_others_posts, manage_options, and dozens more — not the role label itself. "Editor" is simply the name WordPress gives to one specific, pre-assembled bundle of these capabilities.

Where this becomes real code, later

This distinction is presented here purely as a mental model. WordPress Intermediate/Advanced 8 shows the actual PHP mechanism — real code checks current_user_can( 'publish_posts' ), never "is this user an Editor?" directly — giving this chapter's own role hierarchy its real, code-level enforcement.

Assigning Roles

Users → Add New creates an account with a chosen role from the start; Users → All Users → Edit changes an existing user's role. By default, a WordPress user holds exactly one role at a time — though plugins exist that allow finer-grained, custom capability combinations beyond the five defaults.

Choosing the Right Role — A Practical Guide

Situation	Appropriate role
A one-person personal blog	Administrator only — no other users needed
An occasional guest blogger, content not yet trusted	Contributor
A hired content manager who shouldn't touch site settings or plugins	Editor
A regular staff writer publishing only their own articles	Author
A community member who just wants to comment with an account	Subscriber

Default to the least access that still gets the job done

Granting Administrator access "because it's easier" instead of thinking through what a person actually needs is a genuine, common mistake — the same least-privilege principle covered in real depth in Database Security's own material, applied here to WordPress user accounts specifically. Every account with more access than it needs is one more account whose compromise would do more damage than necessary.

Hands-On Exercises

Exercise 1

A site owner hires a freelance writer who should only ever be able to publish their own articles, never touch anyone else's. Explain which role fits, and why an Editor role would grant more access than necessary.

📄 View solution

Exercise 2

Explain, using this chapter's own material, why "Pending Review" as a post status would have no purpose on a site with only an Administrator account and no other users.

📄 View solution

Exercise 3

Explain what this chapter means by describing roles as "named bundles of capabilities" rather than the actual mechanism WordPress checks, and why this distinction is worth knowing even before seeing any real code.

📄 View solution

Chapter 8 Quick Reference

Administrator — everything; Editor — all posts, no settings; Author — own posts only; Contributor — write but can't publish; Subscriber — profile only
"Pending Review" (WordPress Fundamentals 3) exists specifically to serve the Contributor role
Roles are named bundles of individual capabilities — WordPress checks capabilities, not role names, in real code (WordPress Intermediate/Advanced 8)
Assign roles via Users → Add New or Users → All Users → Edit
Default to the least access that gets the job done — the same least-privilege principle from Database Security, applied to WordPress accounts
Next chapter: Comments & Site Interaction