The principle is old in security thinking. Each user should have the minimum access necessary to do their job. Nothing more. The principle has a name, “least privilege,” and it applies to websites the same way it applies to corporate networks and physical security.
In practice, most websites violate this principle. Admin accounts get created for people who do not need admin access. Old accounts stay active for people who have left. Permissions accumulate over time without review. The result is more risk than necessary.
This piece covers why user permissions matter, what good permission practices look like, and how to actually implement them on your site.
Why User Permissions Matter
The case for careful permission management is concrete.
Each Admin Is an Attack Surface
Every admin account is a potential entry point. If any admin account gets compromised (through weak password, phishing, malware), the attacker has full access to the site.
More admin accounts means more entry points. Fewer admins means smaller attack surface.
Mistakes Multiply With Access
Higher-permission users can do more damage by accident. An editor who deletes a post by mistake loses one post. An admin who deletes the wrong things can lose entire sections of the site.
Limiting permissions limits the blast radius of mistakes.
Insider Threats
Most insider threats are accidental rather than malicious. Employees with too much access do things they should not because they can. Limiting access limits the damage from these incidents.
When malicious insider threats happen, the same access controls matter even more.
Compliance Requirements
Many regulations require access controls. PCI DSS for payment data. HIPAA for medical data. SOC 2 for various business contexts. Without proper permission management, compliance fails.
Departing Employee Risk
When employees leave, their access needs to be removed promptly. Without good permission management, departed employees often retain access for weeks or months. The access can be used or sold.
How WordPress Permissions Work
WordPress has a built-in role system that covers most needs.
Administrator
Full access. Can do everything. Should be limited to a small number of people who genuinely need full control.
Editor
Can publish and manage content from all users. Cannot install plugins or themes, cannot manage users, cannot change site settings.
Good for senior content people.
Author
Can publish and manage their own content. Cannot edit content created by others. Cannot do anything beyond content.
Good for content creators who should not affect others’ work.
Contributor
Can write content but cannot publish it. Their work goes to editors for review.
Good for outside writers or junior contributors.
Subscriber
Can only manage their own profile. Useful for sites that require login but do not want users to create content.
Customer (WooCommerce)
For e-commerce sites, customers have a specific role. They can manage their own orders and account details.
Shop Manager (WooCommerce)
E-commerce administrative role. Can manage products, orders, and store settings without full WordPress admin access.
Custom Roles
For sites with specific needs, plugins like Members or User Role Editor let you create custom roles with precisely the permissions needed.
This is useful when the standard roles do not match how you want to assign access.
Common Permission Mistakes
Patterns of mistakes appear repeatedly.
Everyone Is an Admin
The biggest mistake. Every user gets admin access regardless of what they need.
This is often done out of convenience. Setting up specific roles takes a few minutes. Making everyone admin is faster initially.
The cost shows up later. Mistakes propagate further. Compromise impacts are larger. Departures require more cleanup.
Default Admin User Active
WordPress used to default to creating an “admin” user during installation. Many older sites still have this account active.
Brute force attacks target the “admin” username specifically. Removing it makes attacks harder.
Old Accounts Not Cleaned Up
Employees leave. Contractors finish their work. The accounts stay. Sometimes for years.
Each old account is a potential entry point. Old accounts with weak credentials are especially risky.
Single Account Shared by Multiple People
Sometimes teams share a single admin account. Multiple people use the same credentials.
This creates multiple problems. Audit logs cannot distinguish who did what. Password changes affect everyone. Lost passwords mean everyone loses access at once.
Each person should have their own account.
Over-Privileged Customers
For sites with customer accounts (e-commerce, membership sites), customers sometimes get more permissions than they need. The result is that customer accounts can affect things they should not.
Default Subscriber Roles for Forms
Some plugins create accounts when users submit forms, often with Subscriber or higher roles by default. If not managed, these accounts accumulate.
Implementing Better Permissions
Several practices improve permission management.
Audit Current Users
Start with what you have. List all users. For each one:
Who are they?
What role do they have?
What do they actually need?
Are they still active?
The audit usually reveals issues.
Apply Least Privilege
For each user, set the lowest role that allows them to do their job. Editors instead of admins where possible. Authors instead of editors where possible. Contributors instead of authors where possible.
Limit Admin Accounts
Admin accounts should be rare. Only people who genuinely need full control. For most sites, that means one or two admins.
Most users (including most content creators) do not need admin access.
Remove Old Accounts
Accounts for people who have left should be removed promptly. Accounts that have not been used in months should be reviewed and likely deactivated.
Set up a process for removing access when employees leave or contractors finish.
Use Individual Accounts
Every user gets their own account. No shared accounts.
This enables proper auditing and avoids the problems of shared credentials.
Document Roles
Write down what each role can do and what each role is for. The documentation helps when assigning permissions to new users.
It also helps during audits and incident response.
Specific Permission Strategies
Different site types benefit from different approaches.
Single Author Blogs
Just you. One admin account. Maybe a customer account for testing. No need for elaborate permission structures.
The focus is on protecting the single admin account with strong credentials and 2FA.
Multi-Author Blogs
Editor for senior content managers. Authors for individual writers. Contributors for guest writers. Admin only for site owners.
This separation lets contributors write without affecting site configuration.
E-Commerce Sites
Customers as Customer role only. Shop staff as Shop Manager. Editors for content management. Admins only for site owners.
WooCommerce roles handle most of this. The default permissions are usually appropriate.
Membership Sites
Subscribers or Members for paying users. Authors or Editors for content team. Admins for site owners.
Custom membership plugins often add their own role structures.
Business Sites
Editors for content team. Limited admin accounts for site owners and trusted managers. No admin access for regular employees.
Marketing, communications, and content people usually only need Editor.
Agency-Managed Sites
The agency gets admin access during the engagement. Client gets editor access for content updates. After the engagement ends, agency access gets removed or limited.
The transition between active engagement and post-engagement maintenance is where access often does not get updated correctly.
Beyond Standard Roles
For more sophisticated permission management.
Custom Roles
Plugins like Members or User Role Editor let you create custom roles with specific permissions. Useful when the standard roles do not match your needs.
For example, you might create an “SEO Manager” role that can edit metadata and Yoast settings but cannot edit content.
Capability Management
WordPress permissions are based on capabilities (specific permissions like “edit_posts” or “manage_options”). Roles are just collections of capabilities.
For very specific needs, you can manage capabilities directly rather than through standard roles.
Section-Based Permissions
Some plugins let users edit only specific sections of the site. Useful for sites where different teams manage different content areas.
Approval Workflows
Some sites need approval flows. Contributors submit content. Editors review and approve. Publishers schedule and release.
Workflow plugins (like Edit Flow or PublishPress) handle this.
Time-Limited Access
For temporary access, plugins exist that create accounts with expiration dates. Useful for contractors, freelancers, or temporary consultants.
Maintaining Good Permissions Over Time
Initial setup is just the start. Ongoing maintenance matters.
Regular Audits
Quarterly user audits catch issues. New people added who should not have been. Old people not removed. Permissions that grew over time.
Block time for this regularly.
Onboarding & Offboarding Processes
Document the process for adding new users and removing departing ones. Without process, things slip.
For organizations, this becomes part of HR procedures.
Change Tracking
Document who has what access and when changes happen. This is useful for compliance and for incident response.
Plugins like Stream or WP Activity Log track changes to permissions.
Review After Incidents
After any security incident, review permissions. Who had access to what was compromised? Should those permissions have existed?
The incident often reveals permission issues that should be addressed.
Closing Thoughts on Access Control
User permissions are one of those security topics that does not get attention until something goes wrong. Most sites operate with more permissive permissions than they should. Most sites also experience problems that better permission management would have prevented or limited.
For most sites, the right approach is straightforward. Audit current users. Apply least privilege. Remove old accounts. Use individual accounts. Document who has what access. Review periodically.
The cost of this work is small. The protection is real. The blast radius of any incident gets limited. The damage from mistakes gets contained. The recovery from departures gets simpler.
Sites with good permission practices handle security incidents better than sites without them. The incidents are smaller, the cleanup is faster, the lessons are more focused. Sites with poor permission practices have larger incidents with broader impact.
If you have not reviewed your site’s permissions recently, today is a reasonable day to do so. Pull up the user list. Look at each one. Ask if the access is still appropriate. Make changes where it is not. The work is bounded. The improvement is concrete. After the audit, set a calendar reminder for the next one in three months. The discipline of regular review keeps permissions aligned with current needs rather than accumulating drift over time. Sites that take user permissions seriously are protected against problems that sites with sloppy permissions experience repeatedly. The investment in proper access control pays back through avoided incidents.
