WordPress User Roles Explained: Capabilities and How to Change Roles

This article is a localized edition of the Japanese original. Read the Japanese original

In WordPress, each user is assigned a role, and the capabilities that role contains decide what the user can do. Choosing roles carefully lets you, for example, keep people who only write posts away from plugin settings.

The tables in this article were checked against the official wordpress.org documentation "Roles and Capabilities" and the WordPress source code as of November 2026.

Default roles

• Installing WordPress creates one Administrator account.
• Unlike the other roles, Super Admin is not assigned per site; it is set in the Multisite network settings (the list of Super Admins). On a single site, the Administrator is effectively the Super Admin.
• The official documentation notes that roles are not a hierarchy; they describe each user's responsibilities on the site.

Key capability differences

This table picks out the capabilities that most often matter (Yes means the role has it).

Note that Contributors can't upload media (they lack upload_files). If a Contributor writes posts with images, either hand the images to an Editor or add the capability (see below).

Differences on Multisite

On Multisite, site Administrators do not have the following capabilities; only Super Admins do.

• Updating WordPress core, plugins and themes (update_core, update_plugins, update_themes)
• Installing and deleting plugins and themes, and editing files (install_plugins, install_themes, delete_plugins, delete_themes, edit_plugins, edit_themes, edit_files)
• Creating, editing and deleting users (create_users, edit_users, delete_users)
• unfiltered_html (on Multisite, neither Administrators nor Editors have it)

Change a role in the admin screen

• One user at a time: go to Users → All Users, click Edit for the user, choose a Role and click "Update User".
• Several users at once: on All Users, check the users, pick a role from "Change role to…" above the list, and click "Change".
• Default for new users: set "New User Default Role" under Settings → General. On sites that allow registration, leaving it at Subscriber is the safe choice.

Check and change roles with WP-CLI

# Check a user's role
wp user get username --fields=ID,user_login,roles

# Change the role (removes any other roles)
wp user set-role username editor

# Add a role (keeps existing roles)
wp user add-role username author

# Remove a role
wp user remove-role username author

# List users with a given role
wp user list --role=administrator --fields=ID,user_login,user_email

You can list roles and capabilities with WP-CLI too.

# List the roles on the site (including ones added by plugins)
wp role list

# List the Editor role's capabilities
wp cap list editor

# List a user's capabilities (including those from their role)
wp user list-caps username

Add or remove individual capabilities

When a whole role is too broad, add or remove individual capabilities. Changes are saved to the database and remain even if you deactivate plugins or switch themes.

# Let all Editors edit menus and widgets
wp cap add editor edit_theme_options

# Let all Contributors upload media
wp cap add contributor upload_files

# Add or remove a capability for one user only
wp user add-cap username upload_files
wp user remove-cap username upload_files

Giving edit_theme_options to Editors also lets them change Appearance settings (menus, widgets, the Site Editor). Make sure that scope is what you want before adding it.

To restore the default roles, use these commands.

# Restore the Editor role's default capabilities
wp role reset editor

# Restore all default roles
wp role reset --all

Create a custom role

With WP-CLI

You can create a new role based on an existing one.

# Copy the Editor role to create "Site Manager"
wp role create site_manager 'Site Manager' --clone=editor

# Add any extra capabilities you need
wp cap add site_manager edit_theme_options

# Delete it when no longer needed
wp role delete site_manager

With code

A role created with add_role() is stored in the database. There is no need to run it on every page load; running it once when the plugin is activated is enough. If a role with the same name already exists, add_role() does nothing, so later changes to the capability list won't take effect.

<?php
/**
 * Plugin Name: Site Manager Role
 */

register_activation_hook( __FILE__, function () {
	add_role(
		'site_manager',
		'Site Manager',
		array(
			'read'               => true,
			'edit_posts'         => true,
			'edit_others_posts'  => true,
			'publish_posts'      => true,
			'edit_pages'         => true,
			'upload_files'       => true,
			'edit_theme_options' => true,
		)
	);
} );

register_deactivation_hook( __FILE__, function () {
	remove_role( 'site_manager' );
} );

Save it as wp-content/plugins/site-manager-role/site-manager-role.php and activate it on the Plugins screen. Deactivating the plugin deletes the role, and users with that role lose its capabilities, so move them to another role before deactivating.

If you want finer control, there are plugins that let you edit capabilities from the admin screen (such as User Role Editor).

Where roles are stored in the database

Role definitions are stored in wp_user_roles in the wp_options table, and each user's assignment in wp_capabilities in the wp_usermeta table (both assume the wp_ prefix; on Multisite subsites the site number is included, as in wp_2_capabilities). To just look, use this SQL.

SELECT user_id, meta_value
FROM wp_usermeta
WHERE meta_key = 'wp_capabilities';
-- Example result: a:1:{s:6:"editor";b:1;}

The values are serialized, so editing them directly is easy to break. Make changes in the admin screen or with WP-CLI.

Day-to-day tips

• Give the Administrator role only to people who need it. Author is enough for writing posts, and Editor for also fixing other people's posts.
• When someone leaves or a contractor's work ends, delete the account or downgrade it to Subscriber.
• Plugins such as WooCommerce add their own roles (for shop managers, customers and so on). Check them with wp role list.
• If someone lacks the capabilities they need, adding just those capabilities is safer than promoting them to a higher role.

See also How to customize user roles and capabilities.

Summary

• The five default roles are Administrator, Editor, Author, Contributor and Subscriber, with Super Admin added on Multisite.
• Change roles with "Change role to…" on All Users, or with wp user set-role.
• Fine-tune individual capabilities with wp cap add / wp user add-cap, and use wp role reset to go back to the defaults.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)