Do you want to add or remove capabilities to user roles in WordPress?
WordPress comes with a simple but powerful user management system. Each user has capabilities based on the roles they are assigned.
In this article, we’ll show you how to modify user roles in WordPress by adding or removing capabilities from user roles.
Why Add or Remove User Role Capabilities in WordPress
WordPress comes with a built-in user management system and some predefined user roles and permissions.
As an Administrator, you have the ability to perform any action on your WordPress website. For instance, you can add or remove new users, install plugins and themes, delete content, and more.
If you run a multi-author WordPress blog, then you can add other users with Editor, Author, or Contributor user roles. This gives them user role permissions to add new content, but they cannot do administrative tasks.
WordPress also comes with a Subscriber role so users can log in to your site and manage their profiles.
Similarly, WordPress plugins can also create user roles with custom permissions. For example, eCommerce plugins can create a user role for customers with specific custom permissions, or a membership plugin can create its own custom user roles for members.
But what if you wanted to give a user role certain extra permissions or take away some existing permissions?
For instance, you may want to take away publishing permission from the Author user role, or allow Authors to edit other user’s blog posts.
What if you wanted to create a totally custom user role with limited capabilities?
That being said, let’s take a look at how to easily modify user role capabilities in WordPress and create custom user roles with specific permissions.
Add / Remove User Role Capabilities in WordPress
The first thing you need to do is install and activate the Members plugin. For more details, see our step by step guide on how to install a WordPress plugin.
Upon activation, you need to visit the Members » Roles page and click on the Edit link below the user role that you want to modify.
This will open the user role editor where you will see different sections in the left column and available capabilities to the right.
You’ll notice two checkboxes to Grant or Deny the permission next to each capability.
If a user role is granted permission that you want to take away, then you need to uncheck the Grant option and check the Deny box.
For instance, if you want to prevent the Author user role from publishing blog posts, then you need to switch to the Posts section and then check the Deny box next to the ‘Publish Post’ option.
Similarly, you can also give additional capabilities to a user role.
For instance, let’s suppose you want to allow users with the Author user role to be able to moderate comments as well. By default, the Author user role does not give users permission to moderate comments.
To do that, you need to switch to the ‘General’ section and check the Grant box next to the Moderate Comments option.
Don’t forget to click on the ‘Update’ button to save your changes after you are done modifying a user role.
You can now create a new user account with that particular user role and log in to make sure that your customized permissions are working as you intended.
Adding A New User Role with Custom Permissions
The plugin also allows you to create custom user roles where you can select which permissions and capabilities the role would give to the users.
Let’s suppose you have a ‘Movies’ custom post type on your website and you want some users to be able to add movie reviews there. However, you don’t want them to edit any other section.
To do this you’ll need to create a custom user role.
Simply go to Members » Add New Role page. First, you need to provide a title for the custom user role.
After that, you can switch to the section where you want to grant the user the capabilities. For instance, we have a section called Movies for our custom post type on our test site.
There you can give users the permissions to edit and publish content for that post type.
After that, you can review other sections too and see if you want to give users capabilities to do anything else on your site.
Once you are finished, don’t forget to click on the Add Role button to save your changes.
You can now add a new user to your website and assign them the custom user role you just created.
After that, you can log in with that new user account to make sure that everything is working fine. Here is what our custom user role dashboard looked like:
Securely Managing User Accounts in WordPress
Customizing WordPress user roles and permissions allows you to control user access to the admin area of your WordPress website.
However, it also opens up your site to hacking attempts and vulnerabilities. Following are a few things that you can do to make sure that only users with access can securely log in to your WordPress website.
1. Enforce Strong Passwords
WordPress includes a strong password generator by default, but users can skip it. You can add a password policy manager to ensure all users are using a strong password.
2. Enforce Two-Step Authentication
Two-step authentication asks users to enter a one-time code to login to their account in addition to their password. Users can generate this code via an authenticator app on their computers or phone.
For more details, see our guide on how to add two-step authentication in WordPress.
3. Install a WordPress Security Plugin
WordPress security plugins help protect your website by monitoring it for suspicious activity and login attempts. We recommend using Sucuri, which is the best WordPress security plugin on the market.
We hope this article helped you learn how to add or remove capabilities to user roles in WordPress. You may also want to see our guide on how to get a free email domain, or our comparison of the best business phone services for small business.
If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.
Very helpful website!
Thank you
Hi
I’m having an admin user issue after migrating my site from development to live.
It would depend on the error you are receiving, for a starting point you could take a look at our article here: https://www.wpbeginner.com/beginners-guide/beginners-guide-to-troubleshooting-wordpress-errors-step-by-step/
Hi, I thought users were subscribers to my newsletter. I have 7000+. Can I import them to my mailchimp?
Hi Marry,
Yes you can, here is a tutorial to export user data, once you have the data you can open it in a spreadsheet program and keep the columns you need. However, when you add them to MailChimp they will be asked to verify their subscription.
This article is very old. Is Capability Manager Enhanced still the WP-Beginner recommended plugin for managing user roles? Thanks!
I really like this plugin.really helped me.but there is a problem.I want to show author my only one plugin setting.and in your pllugin Capability Manager Enhanced i cannot see my plugin option here.I there any solution?
Just wondering, I want my Authors to be able to create posts, and the STATUS of these posts will automatically be: Pending Review OR Draft.
I want the posts made by Authors to be verified and approved by Editor who can publish.
Is this possible with this app?
If so how pls?
If a user cannot see everything in the admin menu is there a way they can use only one of the features? For instance, I’d like them to only be able to backup their website. Is there a way to add that to a role?
Thank you very much1 this is what I exactly looked for
I would like to grant access to a subscriber ONLY to the entries of a specific gravity form on my site to read live and export but not edit the form or the settings and/ or be able to view any other backend admin areas.
The data input into the form is needed as well as the files that will uploaded on the form submission.by the subsciber. I am trying to find a secure way to give access for a designated period of time. I have one web site and it is Not set up for multi site functions
Please advise. Any direction would be greatly appreciated.
Thank you so much! The best answer of what I was looking for. I am glad I found you
Thank you. Much better than the documentation.
Thanks.. Its great… you made my week.. Cheerss.. keep clam and happy coding..
i want to specify one of my taxonomy to be editable by one person
is there a way to do this ??
http://wordpress.stackexchange.com/questions/161089/how-to-specifies-an-author-editor-to-edit-one-category-only
any chance you release or test it for 3.9.2 and higher? 3.7.1 is more than 10months old. so you nice plugin wont be used anymore if its a risk to use.
I’m the admin of a blog . I have a author also . I disabled publish for author so that i can review posts before publishing but , as author click on submit for review , i am not getting any notification to review that ? Pls Help
We use Edit Flow plugin for that.
Dear Sirs,
Thanks by the post!
I have this plugin installed, is there a way to make the subscribers upload images, and see just their images?
Now subscribers here just can edit their profile and upload images, but they can see other images of gallery too.. I think it is better to them see just their images….
Thanks and Regards,
Tony
how come no reply? i think it’s not possible because it’s a wordpress feature.
Thanks !
How about adding and removing permissions for installed plugins and specific menu items in the left WP navigation?
Hi. I am interested in finding out that as well.
How do you give access to a new plugin/menu option eg. Calendar / staffing
thanks
What if I don’t have permission to install plugins?
Then you can not install plugins.
I think that Justin Tadlock’s Members is a far more comprehensive (read: useful) plugin than the one featured in this article
Piet I have to agree. The Members plugin lays it all out and as an admin all you have to do is check/uncheck permission boxes. So far, so good for me.
Thanks a lot