Assigning unique user roles for WordPress Multisite allows administrators to manage the website properly and restrict some user’s capabilities to their own preference. The role hierarchy can allow you to streamline the work process without having to worry about security measures – as long as these user roles are assigned appropriately, of course.
But do Multisite user roles differ compared to a standard WordPress installation? Well, the Super Administrator role is the big difference. In a standard WordPress installation, the Administrator is the highest role. In Multisite, Super Administrator is above Administrator.
Plus, in Multisite, user roles can be assigned at the network level or for specific sites within the network, which isn’t needed in a solo install. Let’s look at the key user roles that you’ll find in your WordPress dashboard.
Default user roles in WordPress
WordPress has 6 main user roles by default: Super Admin, Admin, Editor, Author, Contributor and Subscriber.
Super admin
As the highest role for managing the WordPress backend, the super admin has ultimate control over all available website functions. This user role is unique to WordPress Multisite.
Basically, super admins have the authority to customize themes, activate plugins and manage users for all subsites in the network. In addition, they can create new websites, delete underperforming websites, remove administrators, and change content.
Administrator
The administrator has full control over the management of a single website and has a similar dashboard interface to the super administrator. Typically, a website is managed by a single administrator, but nowadays you’ll find lots of websites with multiple admins.
This role gives users the right to intervene in most of the website’s settings. This can include managing themes and plugins, assigning other user roles, adding and removing users and changing content.
Editor
The main function of editors is that they can edit and schedule published posts for the website.
This role also enables the moderation of comments and the editing of categories. Before publishing posts, editors can modify their own texts and the texts of other, lower user roles to ensure accuracy. However, editors cannot manage topics and plugins that are controlled by higher user roles.
Author
The author role allows users to contribute their own writing to the websites. In addition to changing content and removing posts, the author can access the WordPress media library to add images. This user role is quite limited and is typically what website owners will provide writers for their website.
Contributor
The Contributor role, another role usually assigned to bloggers and freelance writers, allows them to submit written work easily. With this role, submitted posts can be reviewed and edited before publication.
Access to the media library is restricted for contributors. In addition, they cannot publish any contributions until they have received approval from the editors or administrators.
Subscriber
Subscriber status is the role with the least options and allows users to manage their reading subscriptions. However, they are not able to publish posts and manage plugins.
Apart from the user roles mentioned above, WordPress allows additional roles depending on the website type. For a WooCommerce website, for example, administrators can assign users the role of store manager to manage orders and products.
How to set up user roles in WordPress Multisite
Follow the steps below to add, remove and set user roles in WordPress Multisite.
Add users
Administrators have several options for adding new user roles to the Multisite system. Want a simple approach without having to install plugins? Use the following instructions to add users via the integrated WordPress interface:
Log in to the WordPress admin dashboard. Then, select Users > Add new.
Fill in the mandatory information in the Email and Username fields. Then enter optional information in the First name, Last name and Website fields.
Once you’ve done this, you can assign the correct roles to the new users using the Role drop-down list. Then, specify how you want to send the password to new users.
Finally, save the settings by clicking on Add new user. Alternatively, you can also add new users by accessing the WordPress database. However, we do not recommend this method unless you are an expert.
Remove Users
Here’s how to remove users:
- Select the Users link in the administration toolbar.
- Check the box next to the users you want to delete.
- Click Delete in the Bulk actions drop-down menu.
- Click on the Apply button.
You can also edit the theme files with code snippets to remove user roles in WordPress. To avoid the risk of system errors, you should create a backup for further recovery.
To do this, go to Appearance > Theme file Editor. Then, open the theme function file and enter the snippet:
remove_role(“…”)
In the ellipsis, you can enter Contributor, Author, Editor or Subscriber to remove the corresponding roles.
Assigning user roles with plugins
Instead of assigning roles via the WordPress interface, you can activate plugins to speed up the process. Let’s look at 5 plugins that can streamline your multisite management.
1. User switching
User Switching allows users to flexibly switch between different accounts. When switching accounts, the accounts are automatically logged out and logged in again.
Main features: The plugin helps in testing the website or supporting WooCommerce site customers. It provides administrators with the following features:
- Allow your account to turn back on while logging out of the system.
- Allows you to quickly switch to other accounts in the network admins via the user screen.
- Support compatibility with various plugins such as WooCommerce, bbPress, Multisite and BuddyPress.
This plugin also secures users’ information through procedures related to security system and role usability area. Specifically:
Ensure that only roles that have the right to assign other user roles can switch accounts.
Guarantee that the password is not disclosed.
Remember the accounts through the cookie authentication system.
Support Secure Socket Layers (SSL) for smooth administration.
Support user session validation.
Ensure that you do not involve third-party resources and do not share data with other parties.
2. User role of BestWebSoft
This plugin provides comprehensive features for managing user roles. In particular, you can easily assign and remove user roles. It also enables quick manipulations by allowing administrators to copy the permissions of other roles.
The User Role Plugin offers users free and professional packages. The free options include basic features for managing role functions, displaying information and quick settings without customizing codes.
Meanwhile, the premium options offer unlimited options for customizing user roles and managing plugin access. In addition, administrators can configure the network’s subpages and reset the role to default mode. Plus, the premium options make your experience easier when providing answers to your questions.
3. WPFront user role Editor
The third plugin integrates all the necessary features for managing user roles. In fact, WPFront User Role Editor supports operations with multiple features across free and pro packages.
The free option enhances the experience of administrators with core features such as adding, removing, restoring and migrating user roles. You can also change the capabilities of user roles. The Pro option allows more permissions in terms of media library, user level, widget, posts and other items.
4. Password protect WordPress
Password Protect WordPress (PPWP) helps to secure your WordPress website with an all-in-one solution.
This plugin generates passwords to protect the data of categories, products, posts or the entire website.
WordPress Multisite integration allows you to protect your multisite network with passwords and grant access to specific user roles. This means that managing multisite users and controlling who can access your content is no longer a complicated task.
However, this plugin does not support the protection of images embedded in the protected pages/posts. You need to install Prevent Direct Access (PDA) Gold to prevent readers from accessing the direct file URLs.
5. Prevent Direct Access
Speaking of Prevent Direct Access, PDA is a powerful plugin for protecting digital content such as images, eBooks, videos and documents. Administrators can protect all uploaded files via an intuitive interface connected to the media library.
In addition, Multisite integration helps to protect files on multisites and restrict access to these files by user roles. Learn how to set up the WordPress multisite media library and protect it with the PDA plugin here.
This plugin supports the user experience with the following advanced features:
- Use IP addresses to restrict access
- Generate private download links for files
- Set expiration time and usage limit for the file download links
- Avoid the risk of image theft for reuse on other websites
- Customize the 404 page by providing a landing page for accessing the blocked media files
- Support for the protection of private folders and files through the premium Folder Protection add-on
Conclusion
It’s worth noting that subscriber is the default role for new users. This role allows new users to create profiles, read and comment on posts, but not much else. Contributor, Author and Editor all have greater access, but only those with Admin capabilities can complete certain tasks like plugin management.
Bear in mind that the administrator can also assign multiple roles to one person, so you can customize the users’ scope of use by allowing them access to other roles. Managing multisites through user roles can maintain system security, so it’s a good idea to get all of your user roles assigned properly.
