One of WordPress’s strengths is its flexible user role system. This lets you give each person the right level of access to your website.

With WordPress, you decide what each user can do, so not everyone has full control. This keeps your website secure and lowers the risk of accidental changes or deletions.

How we set up our clients’ websites

When we build a WordPress website, we usually set it up like this:

Client: Editor
Good Websites: Administrator

This setup gives our clients all the access they need, while we look after the technical side of the website.

They can

• Create and update pages
• Add blog posts or news articles
• Manage blog comments
• Upload images
• Manage their website content
• Access our custom options page to update contact details, slider items, footer content, and other website-wide information.

But they can’t accidentally

• Delete important plugins
• Change website settings
• Break something important
• Disable security features

This makes the backend cleaner, safer, and easier to use.

We take care of the technical side as part of our WordPress Management Plan, including WordPress updates, plugin updates, backups, and security. This lets our clients focus on running their business.

Need Administrator access?

Sometimes clients genuinely need Administrator access.

Not a problem.

Because we manage and maintain multiple client websites, we have a few house rules.

• Theme files can’t be edited from within WordPress.
• New Administrator accounts should be discussed first.
• Installing new plugins or themes isn’t permitted on the Live website without checking with us first.
• Deactivating plugins is generally not a good idea.

Most plugins look harmless, but some can slow down your website, cause conflicts, or create security problems. We always test new plugins and major updates on our development server and staging area before they’re installed on the Live website.

The five standard WordPress user roles

WordPress has five standard user roles, each with its own level of access. Here’s a quick overview of what each role can and can’t do.

Administrator

The Administrator has full control of the website. This role can manage content, users, plugins, themes, and all settings.

Most small business websites only need one or two Administrators.

Many people think they need Administrator access to manage their website, but that’s not usually the case.

In reality, an Editor can do almost everything a business owner needs to do. Administrator access is mostly for managing the website itself, rather than managing its content.

Editor

Editors can create, edit, publish, and delete content, but they can’t change technical settings.
This is the role we use for almost all of our clients.

Author

Authors can create and publish their own blog posts, but they can’t create pages or edit other users’ content.

Contributor

Contributors can write blog posts, but they can’t publish them. An Editor or Administrator has to review and publish their work.

Subscriber

Subscribers can log in and manage their own profile, but they can’t create or edit content. This role is mostly used for membership or e-commerce websites.

Bonus: Extra user roles you might not know about

Some plugins create their own user roles.

Yoast SEO

We install Yoast SEO on every WordPress website we build. Along with its SEO tools, it also creates two extra user roles.

SEO Editor

This role is similar to the standard WordPress Editor role. SEO Editors can optimise pages for search engines, but can’t change the main SEO settings. They also have access to the “Advanced” tab in the Yoast meta box, where they can change robots meta tags (like setting a page to noindex or nofollow) or update the canonical URL.

SEO Manager

The SEO Manager has full access to all Yoast SEO settings.

We usually give this role to SEO companies working for our clients. It gives them everything they need without full Administrator access.

WooCommerce

For e-commerce websites, we use WooCommerce. Installing WooCommerce adds two extra user roles.

Customer

Customers are people who buy from your online shop. They can log in, view orders, and update their account details, depending on the theme setup.

Shop Manager

For WooCommerce websites, we usually give clients the Shop Manager role instead of Editor. This gives them everything they need to run their online shop. They can manage products, process orders, issue refunds, and view sales reports without full Administrator access.

Every business is different, so there are always exceptions. But for the vast majority of small business websites, this setup has proven to be the safest, simplest, and easiest to manage.

Our philosophy is simple: give people the access they need, but no more than they need.

This keeps the WordPress backend cleaner, reduces the risk of mistakes, and lets everyone focus on what matters to them.

If someone needs more access later, it’s easy to add.