Most client staff should be Editors or Authors, not Administrators. Only one or two trusted people need the Administrator role, because administrators can install plugins, change themes and manage users. Fewer admins means fewer accounts whose theft hands over the whole site.
WordPress ships with five default roles, and the choice you make on day one tends to stay for years.
What each default role can do
The WordPress roles documentation defines them like this.
| Role | Who it suits | Scope |
|---|---|---|
| Administrator | A technical owner | Access to all administration features within a single site |
| Editor | Content lead | Publish and manage posts, including other users' posts |
| Author | Regular writer | Publish and manage their own posts |
| Contributor | Occasional writer | Write and manage their own posts but not publish |
| Subscriber | Members | Manage their own profile |
Capabilities such as install_plugins, edit_users and activate_plugins are listed in the documentation as part of the administrator's toolset, which is why that role is the one attackers want.
Why fewer admins is safer
The hardening guide notes that the dashboard lets administrators edit PHP files by default, calling it often the first tool an attacker will use after logging in, because it allows code execution. A stolen editor login can change content. A stolen administrator login can change code. That difference is the case for least privilege.
A practical setup for client projects
- Give the client's lead one Administrator account, tied to a named person.
- Give day to day staff the Editor or Author role.
- Give the agency its own named administrator accounts, and remove them when the engagement ends.
- Use Contributor for guest writers who need review before publishing.
- Delete accounts you do not recognise.
When someone says they need admin
Ask what task they are trying to do. If it is updating a menu or a form, check whether an Editor can do it. If it is installing a plugin, the answer should usually go through the agency, since each plugin adds code that needs updating.
Add a second step to the login
The WordPress handbook describes two-step authentication as using two of three possible factors, and CISA describes MFA as requiring two or more authenticators. For administrator accounts in particular, turn it on. The handbook cautions that SMS is not a secure channel, so prefer an authenticator app or key where your tooling supports it.
Review quarterly
List users by role, check for leavers and for accounts with more power than the job needs. Record the date in the retainer notes.
Safeguard provides policies and gates on code changes for repositories, and the free scan is a way to see the dependency side.
Quick check
Can an Editor install plugins?
Not by default. The documentation lists install_plugins among the administrator capabilities.
How many administrators does a small site need?
Usually one for the client and one or two for the agency, each a named person.
Sources
- Roles and capabilities, WordPress documentation
- Hardening WordPress
- Two step authentication, WordPress handbook
- CISA, More than a password
Last reviewed: 19 October 2026.
