How To Use WordPress User Roles To Improve Security
If you’re just a single person running your site, then you probably haven’t thought twice about WordPress user roles. However, if you ever want to give someone else access to your site, now or into the future, then knowing how to use these is paramount.
Essentially, with user roles, you can give people access to certain areas of your site. With this, you only give them access to the portions of the site they require to do their work.
Below you’ll learn what WordPress user roles are, why they’re important, and how using them alongside your supportive web hosting service can help to improve your site’s security.
What are WordPress User Roles?
WordPress is equipped with a role management system that allows you to specify what users can and can’t do on your website. As your site grows knowing how to use WordPress user roles is absolutely invaluable.
Each role can be specified based on certain capacities. For example, you can give one user the role to publish a post, while you can give another a role to update your WordPress security plugins and themes. In total there are six default user roles you can use.
1. The Administrator Role
You’re probably already familiar with the administrator role. It’s the role you’ve been assigned when you created your site. Usually, there is only one administrator role and it has access to everything related to your site. They can even conduct a website safety check to ensure the site is free of any malicious malware or viruses.
This role is very powerful and you should rarely give anyone this high-level access to your website.
2. The Super Admin Role
There is a user role that’s technically one step higher than the admin role and it’s called the super admin role.
The super admin role only applies when you have a network of connected WordPress sites using the WordPress multisite installation. This role is responsible for the entire network of sites and has the same privileges and permissions as an admin, but it extends out across the entire network of sites.
If you have a super admin role, then the role of the admin is diminished and you can no longer modify or install plugins and themes, or change user information.
3. The Editor Role
The editor role has pretty high-level access to your site. This role is responsible for content management, so they’ll be able to do things like creating and editing pages and posts. Along with moderating comments and changing categories.
They won’t have access to plugins or themes, but everything related to publishing content is under their jurisdiction and capabilities.
4. The Author Role
The author role is responsible for creating content. They’ll be able to create, edit, and publish posts, but that’s about it.
They won’t have access to any pages and will have no level of administrative access.
5. The Contributor Role
The contributor role has even less access than the author role. With this role, they’ll be able to read the posts on the site, plus edit and delete their posts.
This role doesn’t allow post publishing or the uploading of media files.
6. The Subscriber Role
The subscriber role is commonly used for subscription-based sites. Subscribers usually have access to a stripped down WordPress dashboard where they’ll be able to manage their own profiles.
This role is useful if you want users to sign up to gain access to certain content.
Why User Roles Matter
When your site grows and you have multiple people working in the backend of your site, you need a way to manage these users without getting overwhelmed.
User roles are important for two reasons:
1. They can simplify your workflow.
If you have a developer who maintains your plugin functions and themes, a team of writers, and an editor you can assign them specific roles based upon the job they’re doing. This will make their jobs easier and prevent them from accessing parts of the site not related to their work.
2. They make your site more secure.
By defining user roles you’re giving people access to limited portions of your site. The last thing you want is an untrusted user installing plugins, or themes, or modifying your existing code.
How to Use WordPress User Roles to Improve Security
By assigning different users roles based upon how they’ll be using your site, you will help ensure your site's overall security.
When you give every single site user an admin role you essentially give them full access to your site. Even though you might trust the person you’re assigning an admin role to there are things that can still compromise the security for your site.
For example, they could be using a password that isn't very secure. In that case, if the password is hacked then whoever is doing the hacking will have a full range of your site. However, if you’ve assigned them a specified user role (such as author or contributor) the damage the hacker will be able to do is minimal.
You also never know if another person’s computer is infected. They might not even know, but their computer could have malware or another virus installed. If you give them admin access, instead of a defined user role, this puts your site at risk. In these specific cases, it is also critical that your virus removal tool runs routine website security checks as well.
Overall, by specifying user roles you end up improving the security of your site and help to safeguard it against any user errors.
Hopefully, you see the advantages of utilizing WordPress user roles as your site grows. It’ll not only improve your overall workflow but will improve your security in the process.
In the early stages of starting a website, you want to sit down and figure out a standard structure for your website URLs. (If your website is already established and growing, it’s not too late to do this now, it just might require more work.)
Your URLs always start with the root domain for your website (e.g. www.yourwebsitename.com), so what you want to define is what follows for individual pages.
Your URL structure will directly relate to your larger site architecture. You want your URLs to both reference what’s on the specific page, as well as help situate the website visitor to where this page belongs on the larger website. For example, the URL for a post on your blog should look something like this: www.yourwebsitename.com/blog/nameofyourblogpost
At a glance to the URL, any visitor who reached the post through an outside link would quickly be able to see that they’re on a blog, as well some basic information about the specific blog post on the page.
