Skip to content

Knowledgebase

Creating a WordPress user with the right role

wordpress, security-ssl

Create a separate WordPress user for each person and assign the least role needed for their work. This makes access easier to review and revoke without sharing the site's main administrator credentials.

01 Match the role to the task

In a standard installation, a Contributor can prepare their own posts for review, an Author can manage and publish their own posts, and an Editor can manage broader editorial content. Administrator access includes powerful site-management actions and should be reserved for people who need them.

Plugins can add roles or alter capabilities, and Multisite introduces network-level responsibilities. Review the actual site rather than relying only on a familiar role name.

02 Create the account

  1. Open Users > Add New User with an authorised administrator account.
  2. Enter a unique username and the person's correct email address. Use a public display name appropriate to their content role.
  3. Select the intended role and use the supported account-notification or password-setup process.
  4. Confirm the details before creating the user.
  5. Ask the person to sign in and verify that the required tasks are available without unnecessary administrative access.

How do I verify that the new user has the right access?

Have a new writer create a test draft and follow the intended review process. A Contributor may not have upload permissions by default, so plan how images will be supplied rather than escalating to Administrator solely to solve one missing button.

Encourage a unique strong password and suitable two-factor authentication. Keep recovery instructions clear and avoid sending passwords through ordinary public comments or support screenshots.

03 Maintain the access record

Record why the account exists, its owner and whether access is temporary. Review it when a project ends or responsibilities change. Deleting a user can affect content ownership, so use the reassignment workflow when removing an account later.

If the invitation or reset email does not arrive, verify the address and the site's mail delivery before creating duplicate users. A WordPress account is separate from a Nabtech client area subaccount, so grant access in the system where the person actually needs to work.

Was this answer helpful?

Need a little more help?

Our support team can help you find the next step.

Contact support

Powered by WHMCompleteSolution