What is a User in WordPress?

You become your site's first user when you install WordPress: the account you create during setup holds the Administrator role. Everyone else who needs to log in, whether a co-author, a developer, or a member, gets their own account with its own login credentials and user role.

Adding a new user

Go to Users → Add New in your dashboard. Two fields are required: a username and an email address, and the email must be unique for each user. Set a password (or have WordPress email the new user their login details), choose a role from the dropdown, and click Add New User. The role the dropdown preselects comes from Settings → General → New User Default Role.

Letting visitors register themselves

Visitors can create their own accounts if you check "Anyone can register" in the Membership section of Settings → General. Self-registered users get the New User Default Role from that same screen, which is Subscriber on a stock install. Keep it at Subscriber: open registration combined with a higher default role hands spam signups the ability to post on your site. If you don't need public signups, leave the box unchecked.

The default user roles

A single WordPress site comes with five predefined roles, and Multisite networks add a sixth, Super Admin. A role is a bundle of capabilities: the individual permissions, like publishing a post or installing a plugin, that decide which actions an account can perform in the dashboard. Plugins can add custom roles or change what the default ones can do.

• Administrator: full control of a single site, including plugins, themes, and other users.
• Editor: publishes and manages posts, including other people's.
• Author: publishes and manages their own posts.
• Contributor: writes and manages their own drafts but can't publish them.
• Subscriber: manages their own profile, nothing more.
• Super Admin: manages every site in a network; this role exists only on Multisite installs.

Give each person the role with the fewest capabilities that still covers the job: Contributor for guest writers, who can draft but not publish, Author for trusted regulars who publish their own work, and Editor for a content manager. Keep Administrator to the one or two people who actually run the site.

One thing roles don't do on their own is gate content: anyone can read published posts, logged in or not. To offer members-only content, pair registered users (usually Subscribers) with a membership plugin; our guide to building a WordPress membership site walks through the setup. For a role-by-role breakdown of capabilities, see The Ultimate Guide to WordPress User Roles.

Deleting a user and ending access

When you delete a user from the Users screen, WordPress asks what to do with the content they authored: attribute all of it to another user, or delete all of it. Choose the second option carelessly and every post they wrote disappears with the account. Reassign their content, then confirm.

Reassigning content and deleting the account is also the reliable way to end someone's access. Demoting the role or changing the password isn't enough on its own: a Subscriber can still sign in, and anyone with access to the account's email inbox can reset the password. If you need to keep the account, change its email address to one you control, reset the password, and click Log Out Everywhere on the account's profile to end its active sessions, or lock it down with a security plugin that disables logins.