How to Create New User Roles in WordPress (2026): Custom Capabilities Without Locking Yourself Out

WordPress ships six roles, and the gap between two of them is 19 capabilities wide. An Editor holds 26. An Author holds 7. Nothing sits in between. So the first time you need somebody who can edit other people’s drafts but never touch a page, the built-in list runs out. That’s what custom roles are for, and building one takes about four minutes.

Quick answer: Install Members (free, 300,000+ installs, 4.9/5 from 1,270 reviews). Open the Members menu, clone the built-in role closest to what you want, then untick what you don’t need. Shipping a theme or plugin to sites you don’t administer? Use add_role() inside an activation hook, and read the trap in the code section first.

Last reviewed: August 2026. Plugin versions, install counts and prices verified.

How We Checked This Guide

Three things got cut before anything else was written. Any plugin without a release in the past six months was out. Any plugin still declaring compatibility below WordPress 7.0 was out too, since WordPress 7.0.3 landed on 6 August 2026. A permissions plugin that hasn’t been retested against current core is a lockout waiting to happen. And any price we couldn’t read on the vendor’s own page was left blank rather than guessed. That’s why you won’t find a WPFront Pro figure below.

What survived came from four source types. The official WordPress.org listing for each plugin gave install counts, versions, ratings, review counts and tested-up-to fields. Vendor pages gave pricing and documentation. The WordPress developer handbook covered core role behaviour. And Patchstack’s State of WordPress Security report, published 25 February 2026, supplied the attack data. Capability counts in the next section were tallied by hand from WordPress’s official role tables. Most guides don’t publish them at all.

Two limits worth naming. We didn’t install these plugins on a live site and time the workflows, so step counts come from vendor documentation rather than a stopwatch. And review distributions tell you about the loudest users, not the average one.

Roles Are Just Bundles of Capabilities

Strip away the naming and a WordPress role is a label attached to a list. That list holds capabilities: single permissions with names like edit_posts, publish_pages or manage_options. A user gets a role, and the role carries the capabilities. Every permission check in WordPress then asks one question. Does this user hold this capability?

Here’s the real distribution across the built-in roles, counted from WordPress’s own capability tables:

• Administrator: 52 capabilities on a single-site install (37 apply everywhere, 15 are single-site only)
• Editor: 26
• Author: 7
• Contributor: 3
• Subscriber: 1, which is just read

Read those as a ladder and the rungs are wildly uneven. Administrator to Editor halves the list. Editor to Author cuts 19 capabilities in one step. Gone at once: pages, comment moderation, categories, and everything touching other people’s content. That 19-capability drop is the gap most growing sites need to fill, and no amount of reassigning built-in roles will fill it.

Not all 52 pull their weight, incidentally. WordPress documents edit_files as “no longer used”, and add_users was replaced by promote_users back in WordPress 4.4. Both still sit in the role definition. Neither is worth copying into a custom role.

All of this lives in one place. The developer handbook puts it plainly. WordPress stores roles and their capabilities “in the options table under the user_roles key”. On a default install that means the wp_user_roles row of wp_options.

One consequence catches people out constantly. Roles are database state, not plugin state. Create a role with User Role Editor, deactivate User Role Editor, and the role is still there. Still assigned. Still enforced. These plugins are editors for a database row, not containers for it. Good news when you want the plugin gone, bad news if you assumed uninstalling cleans up after itself.

Creating a Role With a Plugin

Three plugins own this category and they aren’t interchangeable. One is a capability spreadsheet. One is an access-control system that happens to edit roles. One is built for the moment somebody breaks something. Pick by which of those describes your week. Auditing the whole plugin stack rather than filling one slot? Our must-have WordPress plugins shortlist prices the rest at renewal instead of year one.

User Role Editor: Best for Trimming Capabilities One by One

700,000 active installs. That’s more than the other three plugins here combined. What it buys you is the plainest interface of the group: a wall of checkboxes, one per capability, grouped by type.

Adding a role is two clicks and three fields. Go to Users > User Role Editor and hit Add Role in the right-hand toolbar. Then fill three fields: Role ID (the slug WordPress stores), Role Name (what humans see), and “Make copy of”. That third field is the one that matters. Pick Editor there and your new role starts with all 26 of its capabilities, ready to trim. Leave it empty and you get a copy of Subscriber, one capability, and ten minutes of ticking boxes ahead of you.

Free covers role creation, deletion, capability editing and custom capabilities. Pro adds the restrictions layer. That covers blocking admin menu items per role, hiding widgets and meta boxes, and limiting which plugins a role can activate. It also adds role export and import, plus network-wide management. Pricing runs USD 29 a year for one site, USD 79 for five and USD 159 unlimited. Lifetime licences cost USD 87, USD 198 and USD 318. Against PublishPress Capabilities Pro at USD 69 for a single site, that’s 2.4x cheaper for the same single-site licence.

Ratings tell a slightly awkward story here, though. 4.5 out of 5 reads fine until you open the split. 24 of 288 reviews sit at one star, or 8.3% of everybody who bothered to rate it. Members holds 4.9 across 1,270 reviews, a 4.4x larger sample at a higher average.

• Pros: largest install base in the category; exhaustive, searchable capability list; Pro at USD 29/year is the cheapest paid tier here; network-wide management in Pro
• Cons: dense, unforgiving interface for first-timers; 8.3% one-star reviews; role export sits behind Pro

Best for: administrators who know which capability they want and need to find it fast. Skip if: somebody non-technical will be touching permissions.

Verdict: Buy User Role Editor Pro if you need admin menu items hidden per role on a budget under USD 30 a year. Buy it too if you run multisite and need roles managed network-wide. One site, small team, no budget? Members does the role work free. If a client will edit permissions after handover, PublishPress Capabilities Pro and its automatic backups justify the extra USD 40.

Members: Best Free Option, and the One With a Rescue Hatch

Members gets filed under membership plugins. Ignore the filing. It’s a role editor with content restriction bolted on, it’s free, and it’s rated higher than anything else here.

What earns its place isn’t role creation, which every plugin here does. It’s Administrator Rescue. That’s a time-limited email recovery link, and it restores your Administrator access from the login page when you can’t get into WP Admin. Anybody who has stripped manage_options from the wrong role at 11pm knows why that matters (people do this to themselves more often than they admit). None of the other three list anything like it.

Free also covers assigning two or more roles to one user. It covers explicitly denying a capability rather than just leaving it unticked, cloning roles, and exporting roles to JSON with conflict detection on import. That last one is Pro-only in User Role Editor. So Members gives away free what a competitor charges USD 29 a year to unlock. For scale, PublishPress Capabilities Pro asks USD 69 a year and carries 143 reviews. Members asks nothing and carries 1,270, which is 8.9x the review volume.

Now the honest part. On 11 July 2026, Members disclosed CVE-2026-12426, an unauthenticated disclosure flaw rated CVSS 5.3 (medium severity) affecting every version up to 3.2.22. The bug let attackers use REST API pagination as a yes/no oracle to infer the contents of restricted posts. It was fixed in 3.2.23, and version 3.2.26 is current. Read it as a maintenance signal rather than a red flag. The patch excluded protected posts from REST queries at the SQL level, and three more releases have shipped since.

• Pros: free tier beats both paid competitors on features; 4.9/5 from 1,270 reviews; multiple roles per user; Administrator Rescue; JSON role export
• Cons: content-restriction features are clutter if you only want role editing; patched a CVSS 5.3 disclosure flaw in July 2026; no admin menu blocking

Best for: any site with a team of two to five and no permissions budget. Skip if: you need admin menu items hidden per role.

Verdict: Start here. Members is the default pick for anyone editing roles on a site they own, and the free tier ends the price argument. Move to User Role Editor Pro if hiding admin menu items or managing a network is the actual requirement. Move to PublishPress Capabilities Pro if the person editing permissions next month isn’t you.

PublishPress Capabilities: Best for Handing Permissions to Someone Else

Picture an agency handing a finished site to a client. Within a fortnight that client over-trims a role and phones you about it. That’s the buyer this plugin is built for, and its answer is a safety net rather than a feature list.

Every time permissions change, the plugin writes a backup automatically. Not on request. Not when somebody remembers. Every change, with a rollback menu waiting. Members exports roles to JSON perfectly well, but only when a human clicks export first. That’s exactly the click nobody makes before the mistake.

Beyond that, the toolkit is broad. You get capability control across custom post types and taxonomies, plus element hiding on the Gutenberg and Classic editor screens. Add toolbar and dashboard widget removal by role, and media library permissions. It also handles WooCommerce, Contact Form 7, Yoast SEO and Elementor specifically. Pro adds admin menu editing and per-role restriction of admin screens. It costs USD 69 a year for one site, USD 129 for five, USD 199 unlimited. Against User Role Editor Pro’s USD 29 single-site tier that’s 2.4x the price. Against Members it’s USD 69 versus nothing.

• Pros: automatic backup on every change; deepest custom post type and taxonomy support; per-plugin permission handling; version 2.50.0 is the most recent release of the four
• Cons: USD 69/year single-site is the priciest entry here; 100,000 installs is one seventh of User Role Editor’s 700,000; 143 reviews is a thin sample

Best for: agencies and teams where more than one person can edit permissions. Skip if: you’re the only administrator and always will be.

Verdict: Pay the USD 69 when somebody other than you will edit roles, because you’re buying the rollback and not the checkboxes. Solo site owners should take Members instead and keep the money. Need the same admin-menu blocking for less? User Role Editor Pro does it at USD 29.

WPFront User Role Editor: The Fourth Option

Start with the problem. 30,000 installs is 4% of User Role Editor’s 700,000, and 65 reviews is too small a sample to read much into. That’s the case against it.

The case for it is a feature nobody else here lists. WPFront migrates users in bulk from one role to another. That matters when you’ve built a replacement role and need 200 Contributors moved onto it. It also handles multiple roles per user, restores previously modified roles, and controls navigation menu and widget visibility by role. Version 4.2.4 is tested against WordPress 7.0.3, same as the other three.

Best for: a one-off bulk migration of users between roles. Skip if: you’re choosing a plugin to keep. Verdict: Install it for the migration, then go back to Members for daily work. Members has 10x the installs and a review base roughly 20x the size, so there’s far more to judge it on.

Creating a Role in Code (and the Trap Everyone Hits)

Plugins are the right answer for a site you log into. Code is the right answer for a theme or plugin you distribute, because the role has to exist on installs you’ll never see. The function is add_role(). It takes a slug, a display name and an array of capabilities.

function htg_add_shop_editor_role() {
    add_role(
        'shop_editor',
        'Shop Editor',
        array(
            'read'                 => true,
            'edit_posts'           => true,
            'edit_others_posts'    => true,
            'edit_published_posts' => true,
            'publish_posts'        => true,
            'upload_files'         => true,
        )
    );
}
register_activation_hook( __FILE__, 'htg_add_shop_editor_role' );

Now the trap. add_role() writes to the database the first time it runs, then does nothing forever after. The developer handbook is blunt. “Sequential calls will do nothing: including altering the capabilities list, which might not be the behavior that you’re expecting.” Change the capability array, reload, and the role doesn’t budge. The function returns null and exits, because the role already exists in wp_user_roles.

That’s the whole explanation for the “my custom role won’t update” threads. The code looks right. It is right. It already ran.

Two ways out, and they aren’t equivalent. To change a single capability, fetch the role object and call add_cap() or remove_cap() on it:

$role = get_role( 'shop_editor' );
$role->add_cap( 'manage_categories' );
$role->remove_cap( 'upload_files' );

To replace the capability list wholesale, the handbook says use remove_role() then add_role(). A warning comes attached: “Make sure to do it only if the capabilities differ from what you’re expecting (i.e. condition this) or you’ll degrade performance considerably!” Every unconditional call rewrites a database row on every page load.

So don’t hang either of these on init without a condition. Put creation in register_activation_hook(). Put capability changes behind a stored version number you bump when the role definition changes. Test on a staging copy before it touches production, which any decent managed WordPress host gives you at one click.

Roles on a WooCommerce Store

WooCommerce adds two roles the moment you activate it. Customer behaves like Subscriber plus order history and profile editing. Shop Manager is the one people get wrong.

Shop Manager covers the entire store: WooCommerce settings, reports, products, orders and refunds, coupons and customer accounts. It also carries standard WordPress Editor permissions for posts and pages. What it doesn’t carry is core site administration, and that’s the design. You can hand it to whoever processes orders without handing over plugin installation.

WooCommerce also extends Administrator with two capabilities, manage_woocommerce and view_woocommerce_reports. Building a custom store role? Those two are what you copy across.

The common mistake is cloning Shop Manager for a warehouse assistant who only needs to look at orders. Shop Manager can issue refunds and rewrite product prices. Clone Customer and add order capabilities upward instead. Stores running real volume should also read our WordPress ecommerce hosting guide. Role sprawl and checkout slowdowns tend to show up in the same quarter.

What Changes on Multisite

Multisite moves the goalposts twice, and both moves are quiet.

First, roles are per-site. An Editor on site 3 is nobody on site 7 until you add them there. Each site keeps its own user_roles option under its own table prefix.

Second, single-site Administrators lose 15 capabilities on a network. That includes update_core, install_plugins, install_themes, edit_plugins, edit_themes, edit_users, create_users, delete_users and unfiltered_html. All of them become Super Admin territory. So a role you built on a standalone install behaves differently on a network. Worse, it fails silently. No error, just a button that isn’t there.

Ten more capabilities are network-only. Super Admin holds them alone: create_sites, delete_sites, manage_network, manage_sites, manage_network_users, manage_network_plugins, manage_network_themes, manage_network_options, upgrade_network and setup_network. Super Admin is also the one role there’s no point editing. It holds every capability by default, so you’ve nothing left to grant.

Over-Permissioned Roles Are an Attack Surface

Here’s the number that should shape how you build a role. In Patchstack’s State of WordPress Security report, published 25 February 2026, broken access control accounted for 57% of the attacks its firewall blocked. Privilege escalation added another 20%. Together that’s 77% of blocked traffic aimed at doing something the attacker wasn’t allowed to do.

Those attacks don’t look like attacks. They look like a logged-in Contributor making an ordinary request. Generic firewall rules struggle because there’s no injection pattern to match. There’s only a permission check that should have failed and didn’t.

Role design is where you shrink that surface. Three capabilities deserve attention when you’re building or cloning:

• unfiltered_html lets a user post raw JavaScript into posts, pages, comments and widgets. Editors hold it on single-site installs. On multisite only Super Admin does. Almost no custom role needs it.
• edit_plugins and edit_themes give dashboard file editing. An account holding these that gets phished is a compromised server, not a compromised login.
• promote_users lets somebody change other users’ roles without holding edit_users. That’s a privilege escalation path sitting inside a dropdown menu.

Trimming a role won’t patch a vulnerable plugin. What it decides is how much an attacker gets when one of them fails. Worth doing the other half while you’re in here. Our guide to testing your WordPress site’s security covers the free scans that find the vulnerable plugin in the first place.

Which Route Should You Actually Take

Match your situation to one of these rather than reading four feature lists again.

• Team of 2-5, no budget > Members, free. Role creation, cloning, multiple roles per user, capability denial and JSON export all sit in the free tier. Don’t pay User Role Editor USD 29 a year here. The admin-menu blocking it adds is a problem five people solve with a conversation.
• Agency handing sites to clients > PublishPress Capabilities Pro, USD 69 a year. You’re buying the automatic backup on every permission change, because the client will over-trim a role and call you. Members exports to JSON, but only when somebody clicks export before the mistake.
• Budget under USD 30/year, admin menu must be locked down > User Role Editor Pro at USD 29. It blocks admin menu items, widgets and meta boxes per role, and limits plugin activation. PublishPress does the same job at USD 69, which is 2.4x the price for one site.
• Shipping a theme or plugin to installs you don’t control > code, not plugins. Use add_role() in register_activation_hook(), with capability changes behind a version check. You can’t make somebody else’s site install a dependency.
• Multisite network, 10+ sites > User Role Editor Pro, which lists network-wide role and user management explicitly. Members and PublishPress don’t state it as plainly, so check their current product pages before picking either instead.
• Bulk-moving users between roles > WPFront User Role Editor for the migration itself, then remove it. It’s the only one of the four that lists bulk user migration as a feature.

Frequently Asked Questions

Can you create custom user roles in WordPress without a plugin?

Yes. add_role() does it in a few lines, and it’s the correct choice when you’re shipping a theme or plugin. Put the call inside register_activation_hook() rather than init. The function writes to the database once, then ignores every later call. For a site you administer yourself, a plugin is faster and carries no risk of a PHP fatal error in functions.php.

Is Members better than User Role Editor?

For most single sites, yes. Members rates 4.9 out of 5 across 1,270 reviews against User Role Editor’s 4.5 across 288. Its free tier also includes JSON role export, which User Role Editor keeps behind a USD 29 Pro licence. User Role Editor wins on two counts: 700,000+ installs versus 300,000+, and Pro’s network-wide multisite management. One site, handful of users? Start with Members.

How many custom user roles can you create in WordPress?

Core sets no limit. Every role you add goes into the same wp_user_roles row in the options table, so the constraint is administrative rather than technical. Our rule of thumb: the real limit is how many roles you can still explain a year from now. Before adding one, check whether an existing role plus a single capability change does the job.

How do I reset WordPress user roles back to default?

It depends what changed them. PublishPress Capabilities writes a backup automatically on every permission change, so rolling back is a menu click. WPFront User Role Editor can restore previously modified roles. Members exports roles to JSON, which only helps if you exported before editing. If none of those apply, restore from a database backup taken before the change. Role data lives in one option row that’s easy to overwrite and painful to rebuild from memory.

Can one user have two roles in WordPress?

Not through core, which assigns one role per user. Members and WPFront User Role Editor both add multiple-role assignment. Members is the better-maintained of the two: version 3.2.26 hardened the multiple-roles save routine against a PHP 8 error from malformed role data. Members also lets you explicitly deny a capability instead of just leaving it unticked. That’s what you want when a second role would otherwise grant it.

What happens to a custom role if I delete the plugin that created it?

It stays. Roles live in the wp_user_roles option, not inside the plugin. Delete User Role Editor and every role it created is still assigned and still enforced. That cuts both ways. You can remove the plugin once your roles are settled, but you can’t uninstall your way out of a bad role. Remove it deliberately with remove_role(), or from inside the plugin before you delete anything.

Bottom Line: Clone, Trim, Test

Most people overthink this. Install Members, clone whichever built-in role sits closest to what you need, and remove the capabilities you don’t want. Free, four minutes, reversible. Reach for User Role Editor Pro at USD 29 a year only when admin menu items must disappear per role, or you’re managing a network. Pay for PublishPress Capabilities Pro at USD 69 only when somebody else will edit permissions and you want a rollback behind them. Write code instead of installing anything when the role has to exist on sites you’ll never log into.

One rule whichever route you take: never edit the Administrator role. It’s the only one that can undo your mistakes.

A few neighbouring guides pair with this one. Our WordPress security testing guide handles the other half of the same problem. A trimmed role and a scanned plugin list attack it from opposite ends. Running a store? Our WordPress ecommerce hosting guide covers the infrastructure behind Shop Manager. Building a content team? Our must-have plugins shortlist and our walkthrough for adding a table of contents in WordPress cover what those new Editors will spend their day in. And if roles are changing because the site is outgrowing one person, our managed WordPress hosting comparison lists hosts with one-click staging.