Guide CMS publishing · 9 of 9
WordPress User Roles for a Content Team: Who Can Publish What
Map your content team to WordPress user roles: what each role can do, a four-person example, Contributor vs Author, and a quarterly access review.
Key takeaways
- Give each person the least role their job needs.
- Contributors draft; Authors publish their own; Editors publish all.
- Keep few Administrators and review access each quarter.
WordPress user roles decide who can write, edit, and publish on your site. A small content team usually needs only three of them: Contributor for writers who should not publish, Author for trusted writers who publish their own posts, and Editor for the person who manages everyone’s posts. Keep Administrator for the few people who run the site itself.
This guide maps real editorial jobs to roles, with the least access each job needs. It includes a filled example for a four-person team and a quarterly review checklist. For the full release process, see the blog publishing guide.
The default roles and what they can do with posts
The WordPress Roles and Capabilities documentation lists six default roles. Super Admin applies only to multisite networks. The other five apply to a single site:
| Role | Write | Edit others’ posts | Publish | Manage site |
|---|---|---|---|---|
| Subscriber | No | No | No | No |
| Contributor | Own drafts | No | No | No |
| Author | Own posts | No | Own posts | No |
| Editor | Yes | Yes | Yes | No |
| Administrator | Yes | Yes | Yes | Yes |
In the WordPress documentation, a Contributor can write and manage their own posts but cannot publish them. An Author can publish and manage their own posts. An Editor can publish and manage posts, including other users’ posts. An Administrator has access to all administration features.
One detail matters for daily work: by default, Contributors cannot upload files. If a writer needs to add their own images, either give them the Author role or have an Editor add the images. Image credits also need someone to check them; the image attribution guide covers that step.
Map your team to roles
Start from the jobs, not the people. Most content teams have five jobs:
| Job | What they need to do | Least role that fits |
|---|---|---|
| Writer | Draft posts; submit for review | Contributor |
| Trusted writer | Draft, add images, publish own posts | Author |
| Editor or reviewer | Edit anyone’s post; fix formatting; publish or schedule | Editor |
| Release owner | Publish, schedule, check the live page | Editor |
| Site owner | Plugins, themes, users, settings | Administrator |
The release owner does not need to be an Administrator. Publishing and scheduling are Editor tasks. Settings such as the site time zone are Administrator tasks, so agree in advance who checks them.
Roles control who can act in the CMS. They do not define your review stages or sign-off. Those belong in your workflow; see how to build a content approval workflow.
Worked example: a four-person team
Fictional example. An imaginary home services company has a small content team:
| Person | Job | Role | Reason |
|---|---|---|---|
| Freelance writer | Drafts two posts a month | Contributor | Needs to draft, not publish |
| In-house writer | Writes and adds images | Author | Needs uploads; publishes only after review |
| Content lead | Edits all posts; schedules releases | Editor | Needs to edit others and publish |
| Web manager | Runs plugins, theme, and users | Administrator | Only person managing the site |
The in-house writer can technically publish as an Author. The team agreed that the content lead publishes everything, so the writer submits for review instead. Roles set the limits; your process decides who uses them.
Contributor vs Author: who can publish their own posts
This is the choice teams get wrong most often. Use Contributor when every post must pass review before going live. The writer submits the post, and an Editor publishes it. Use Author when you trust the writer to publish without a second check, or when they need to upload images.
An Author can also edit their own posts after publishing. That is useful for quick fixes, but it means changes can go live without review. If that is a concern, keep the writer as a Contributor and let an Editor handle updates.
What each role means for daily editing tasks
- Pasting drafts: any role that can write can paste content. The Google Docs to WordPress guide covers cleanup.
- Fixing structure: Editors can fix headings and lists in anyone’s post, using the formatting guide.
- Embeds: embed blocks work for most writing roles. Custom HTML may need more access. See the video embed guide.
- Recovering a missed post: only someone who can publish that post can push it live by hand. The missed schedule guide lists the steps.
How a Contributor submits a post for review
A Contributor does not see a Publish button. Instead, the button reads Submit for Review. When they click it, the post status changes to Pending. An Editor finds it in Posts → All Posts under the Pending filter, reviews it, and publishes or schedules it.
Agree on how the Editor will know a post is waiting. Some teams check the Pending list daily. Others add a note in their task tracker when they submit.
How to change a user’s role
- Sign in as an Administrator.
- Go to Users → All Users.
- Tick the box next to the user.
- Open the “Change role to…” menu and choose the new role.
- Click Change, then confirm the role column shows the update.
Tell the person before you change their role, so they are not surprised when a button disappears.
Admin accounts: keep few, review them, remove ex-staff
An Administrator can install plugins and change any setting. The WordPress hardening guide warns that someone who gains access to an administrator account can install malicious scripts. Keep the number of admin accounts small.
- Give admin access only to people who manage the site, not to writers.
- Use a strong, unique password for each account.
- Do not share one login between people.
- Remove or downgrade accounts the day someone leaves.
Review the Users list whenever a project ends or a freelancer finishes. Old accounts with publishing rights are easy to forget and easy to misuse.
Custom roles and role-editor plugins exist for special cases. Most small teams do not need them.
Where DEX fits
DEX publishes approved articles through the connected CMS. If your team uses that connection, ask your site owner which WordPress account it relies on, and include that account in your access review.
Quarterly access review checklist
- Export or list all users and their roles.
- Remove accounts for people who left.
- Downgrade anyone whose role is higher than their job needs.
- Count Administrators; confirm each one is needed.
- Check connected service accounts and their roles.
- Record the date and who did the review.
FAQ
Can a Contributor publish posts?
+
No. Contributors write and manage their own posts but cannot publish them.
Can Contributors upload images?
+
Not by default. Give the Author role or have an Editor add images.
Does the release owner need to be an Administrator?
+
No. Editors can publish and schedule posts.
Sources
- Roles and Capabilities · WordPress.org
- Hardening WordPress · WordPress Developer Resources
Dex SEO is an AI SEO agent for small businesses. Every article here is planned from search data, drafted by Dex, fact-checked against the sources it cites, and reviewed by the team before it is published.
How this article was made: planned and drafted by Dex from search data, fact-checked by Dex (5 claims checked), then approved by the Dex SEO team.