Customizing User Roles and Permissions in WordPress

Why are user roles important in WordPress?

WordPress has a built-in user role system that lets you define exactly what each user is allowed to do on your website. By default, the following roles exist:

• Administrator – Has full access to the site.
• Editor – Can edit, publish and manage content.
• Author – Can write and publish their own posts.
• Contributor – Can write posts, but not publish them.
• Subscriber – Has read-only access.

Why create custom user roles?

Not every website fits this scheme. If you need, for example, a support agent, guest author or course instructor, you can create custom user roles with individual permissions.

Creating user roles: defining a custom role

The add_role() function lets you create a new user role with specific capabilities.

Example: adding a support agent

If you run a WordPress site with a support function, you can create a “Support Agent” role with the following capabilities:

• Can view support requests
• Can edit their own posts
• Cannot publish posts

function create_support_role() {
    add_role(
        'support_mitarbeiter',
        __('Support Mitarbeiter'),
        array(
            'read' => true,
            'edit_posts' => true,
            'delete_posts' => false,
            'publish_posts' => false,
            'upload_files' => true
        )
    );
}
add_action('init', 'create_support_role');

After this code runs, the new user role appears under Users > All Users > Change role.

Adjusting existing user roles

If you want to change an existing role, use get_role().

Example: allowing authors to edit pages

By default, authors can only write posts, but not edit pages. To change that, you can use this function:

function modify_author_permissions() {
    $role = get_role('author');
    $role->add_cap('edit_pages');
}
add_action('init', 'modify_author_permissions');

After this code, authors can edit pages as well.

Removing specific capabilities

If you want to remove certain capabilities from a role, you can use remove_cap().

Example: preventing editors from deleting posts

If you don’t want editors to be able to delete posts:

function restrict_editor_permissions() {
    $role = get_role('editor');
    $role->remove_cap('delete_posts');
}
add_action('init', 'restrict_editor_permissions');

Now editors can still edit content, but not delete it.

Deleting user roles

If you no longer need a user role, you can remove it with remove_role().

function remove_support_role() {
    remove_role('support_mitarbeiter');
}
add_action('init', 'remove_support_role');

Caution: after removing a role, the users in that role must be assigned to another role!

Managing user roles with plugins

If you don’t want to make code changes, there are plugins that let you manage roles and capabilities with a click:

• User Role Editor – Lets you create and change roles in the WordPress backend.
• Members – Adds powerful user management.

How to use User Role Editor:

1. Install the plugin via Plugins > Add New.
2. Go to Users > User Role Editor.
3. Select a role and edit its capabilities.

Checking user capabilities in code

If you want to check permissions directly in code, you can use current_user_can().

Example: showing special content to editors only

If an area should only be visible to editors:

if (current_user_can('edit_others_posts')) {
    echo "Dieser Inhalt ist nur für Redakteure sichtbar.";
}

Additional protection: unlocking pages for certain user roles only

If you want to prevent users with certain roles from opening certain pages, you can redirect them automatically.

function restrict_page_access() {
    if (!current_user_can('administrator') && is_page('geheime-seite')) {
        wp_redirect(home_url());
        exit;
    }
}
add_action('template_redirect', 'restrict_page_access');

Now only administrators can open the “Secret Page”.

Conclusion

User roles in WordPress are highly flexible. With a few lines of code, you can:

• Create custom roles such as “Support Agent”
• Extend or restrict existing roles
• Make content visible to certain roles only
• Manage user roles through a plugin

If you need more control, it pays to configure your own roles and capabilities individually!

We created this blog post with the help of AI.