WordPress user roles and capabilities define what each user can and cannot do on your site. The default roles — Administrator, Editor, Author, Contributor, and Subscriber — cover common scenarios, but most plugin businesses need custom roles with specific permissions. Understanding the role and capability system is essential for building secure, user-friendly plugins.
This guide serves as a complete reference to WordPress user roles and capabilities.
Default Roles
WordPress ships with six default roles. Super Admin has access to all site network administration features in a multisite installation. Administrator has access to all administration features within a single site. Editor can publish and manage all posts. Author can publish and manage their own posts. Contributor can write and manage their own posts but cannot publish. Subscriber can manage their own profile only.
Each role has a specific set of capabilities assigned. Understanding what each role can do helps you assign appropriate permissions to your users.
Understanding Capabilities
Capabilities are the building blocks of the WordPress permissions system. Each action a user can perform — publishing posts, editing themes, creating users — corresponds to a capability like publish_posts, edit_themes, or create_users. Roles are collections of capabilities assigned to a named group.
Check capabilities with current_user_can(‘capability_name’) before allowing any sensitive action. This is more reliable than checking the user’s role name, which can change if roles are modified.
Creare Ruoli Personalizzati
Create custom roles with add_role() during plugin activation. Specify the role slug, display name, and an array of capabilities. Clone an existing role’s capabilities with get_role() and modify them. Remove roles with remove_role() during plugin deactivation.
For plugin-specific roles, prefix the role slug with your plugin name to avoid conflicts. Test custom role boundaries thoroughly to ensure users can’t access functionality they shouldn’t.
Custom Capabilities
Register custom capabilities for your plugin’s specific functionality. Name capabilities following WordPress conventions with underscores: edit_{posttype}, publish_{posttype}, delete_{posttype}. Assign capabilities to appropriate roles.
Don’t check role names directly — use capability checks via current_user_can(). Roles can be modified by site administrators, and plugins shouldn’t assume role structure remains unchanged.
Capability Mapping
For custom post types, use the capabilities parameter in register_post_type() to map custom capabilities to WordPress’s built-in ones. This lets you use manage_options, edit_posts, and publish_posts as the basis for your custom post type permissions without creating entirely new capabilities.
Use the map_meta_cap filter for more complex permission logic — like checking if a user owns the resource they’re trying to edit.
Il punto fondamentale
WordPress roles and capabilities provide a flexible permission system for your plugin. Use the default roles as starting points, create custom roles for your plugin’s user types, register custom capabilities for plugin-specific functionality, and check capabilities with current_user_can() rather than role names.
