On many small websites, everyone logs in with the same administrator account: the owner, the web designer, someone who writes posts. It's convenient, but you no longer know who changed what, and a single leaked password opens up the whole website. Each person needs their own account, with the role they need and nothing more.
What you'll achieve
- choose the right role for each person who works on the website;
- give and remove a collaborator's access without sending them your password;
- delete old accounts without losing their content.
WordPress roles
| Role | What they can do |
|---|---|
| Administrator | everything: plugins, themes, settings, users |
| Editor | publishes and edits everyone's pages and posts, moderates comments |
| Author | writes and publishes only their own posts, uploads images |
| Contributor | writes posts, but can't publish them or upload images |
| Subscriber | only manages their own profile |
WooCommerce adds two roles: Shop manager, who handles products and orders without touching plugins or settings, and Customer, the buyer's account.
The simple rule: one or two administrators, the people who actually look after the website. Whoever writes content gets Editor or Author; whoever processes orders gets Shop manager.
The steps
A. Add a new user
- In WordPress, open Users » Add New User.
- Fill in the person's username and email address. Don't use names like
adminor your company name: they're the first ones bots try. - Leave Send the new user an email about their account checked: the person sets their own password from the link they receive.
- Choose the Role from the table above and click Add New User.
B. Give access to a web designer or an agency
- Create an account for them, as in steps 1–4, with the Administrator role only if they need to install plugins or change the theme. Don't send them your password.
- If they also need Enhance (files, databases), don't give them your Enhance account password: invite them with their own account (see Enhance access for other people).
- When the work is done, change their role or delete their account (step 11).
C. Check the existing accounts
- Under Users » All Users, filter by Administrator. Every account in the list should belong to a person you know.
- Open your profile and look at Application Passwords, at the bottom of the page. These are the passwords used by external apps (for example a phone app or a publishing service). Revoke the ones you don't recognize, with Revoke.
- Also in your profile, under Display name publicly as, choose a name that isn't your username. Otherwise, the name you log in with appears under every post.
D. Delete an old account without losing its posts
- Under Users, hover over the account and click Delete.
- If the person wrote posts or pages, WordPress asks what to do with them. Choose Attribute all content to and pick yourself or another user. Otherwise, the content is deleted along with the account.
- Click Confirm Deletion.
E. From Enhance, without logging in to WordPress
On the website's WordPress page in Enhance (the “Apps” tab), under “WordPress users”, you can see the website's users and change one's password with “Change password”. It's your way in when you've forgotten the password or an attacker has changed it. Also there, “Single sign on” chooses which user the “Login to admin” button logs you in as.
Two-factor authentication in WordPress
WordPress doesn't come with two-factor authentication out of the box. You add it with a two-factor authentication plugin, with codes from a phone app. Turn it on at least for administrators. How to choose the plugin: The plugins a WordPress website needs; for your other accounts, see Strong passwords and two-factor authentication, everywhere.
If something doesn't work
- The new user doesn't receive the email with the link. Check the Spam folder. If it doesn't arrive at all, the website isn't sending email correctly; see Why my emails go to spam: SPF, DKIM, DMARC. In the meantime, you can set a password for them yourself, from their profile, and give it to them through a channel other than email.
- You accidentally deleted a user along with all their content. Restore the database from a backup taken before that (see Backup and restore from Enhance), or write to us.
- There's an administrator in the list you don't know. It may be a sign of a hacked website. Don't delete it yet; follow Your WordPress website was hacked: what to do, step by step.
- You forgot your password and the reset email doesn't arrive. Change the password from Enhance (section E).