WordPress User Roles for a Volunteer Community Team

A guild site I helped clean up last year had 14 people with Administrator access. Three of them had left the community, one had a reused password from a leaked forum, and nobody could say who had installed the plugin that was quietly injecting spam links. Getting WordPress user roles right would have prevented every part of that mess, and it takes about an hour.

Gaming communities run on volunteers: a news writer, a couple of guide editors, a moderator who fixes typos at 2 a.m. Everyone wants to help, and the quick way to let them is to make them all admins. Here is the slower, saner setup I now use for every fan site I touch.

What the Five Default WordPress User Roles Actually Allow

WordPress ships with five roles, and most site owners have only ever used two. The differences matter more than the names suggest.

Role	Can publish	Can edit others' posts	Can install plugins or themes
Administrator	Yes	Yes	Yes
Editor	Yes	Yes	No
Author	Own posts only	No	No
Contributor	No, submits for review	No	No
Subscriber	No	No	No

The line that matters is the last column. Only Administrators can add code to your site. Every plugin, every theme, every "quick fix" snippet goes through that door, so the number of people holding it should be tiny.

Map Your Volunteers to Roles, Not Titles

A volunteer's title in Discord says nothing about what they need in the dashboard. Ask instead what they do in a normal week.

Writes patch notes and news: Author. They can publish their own work fast without touching anyone else's.
New writer on a trial month: Contributor. Their drafts wait for review, which protects you from a rushed first post.
Fixes tier lists and guides written by others: Editor. They need to edit every post and page.
Runs the site's technical side: Administrator. This should be one person, two at most.
Comments and enters giveaways: Subscriber, or no account at all.

On a typical community site of 10 to 20 volunteers, I end up with one or two Administrators, two Editors, and everyone else as Author or Contributor.

Why "Just Make Everyone an Editor" Is Bad Advice

A common shortcut in community forums is to skip the fine-grained roles and give every volunteer Editor access. It sounds safe, since Editors cannot install plugins. I disagree with it for two reasons.

First, Editors can delete or rewrite any post on the site, including pages like your rules or your donation page. One frustrated volunteer leaving after an argument can do real damage in five minutes. Second, by default Editors can post unfiltered HTML, which means a compromised Editor account can still drop a malicious script into a page. It is not as bad as a stolen admin account, but it is not harmless.

Give Editor only to people who truly fix other people's work. Everyone else is happier as an Author anyway, because their own dashboard is less cluttered.

A Monthly Role Audit in 15 Minutes

Volunteer teams change constantly. Someone stops playing the game, someone moves to a new project, and their account sits there with full rights. Put this in the calendar for the first Sunday of each month:

Go to Users and filter by Administrator. Anyone you cannot name a current reason for gets downgraded.
Filter by Editor and repeat.
Sort by last login with a small activity plugin. Anyone inactive for 90 days drops to Subscriber.
Check for accounts with generic names like "admin2" or "test." These are often leftovers from a developer or, worse, an attacker.
Before any big change, take a backup. Our guide on how to back up a WordPress site the right way covers a routine that fits this schedule.

Downgrade rather than delete. When you delete a user, WordPress asks who should inherit their posts, and choosing wrong can wipe a year of guides.

When You Need a Custom Role

Sometimes the defaults do not fit. A common case on gaming sites is the "events coordinator" who needs to update a tournament calendar page but should not touch news posts. A role editor plugin lets you clone the Contributor role and add just the capability needed for that one content type.

Keep custom roles rare. Each one is something you must remember and explain to the next admin. If you find yourself with seven custom roles, your content structure is probably the real problem. Sorting your content properly helps here, and we cover that in choosing between categories and tags for a gaming blog.

Protect the Accounts That Matter Most

Roles limit damage, but strong logins prevent it. For every Administrator and Editor:

Require two-factor login. Most security plugins can force it by role, so Authors stay friction-free while admins are covered.
Use a unique email for the main admin account, not the one shared on your public contact page.
Never share one login between people. If three moderators use "modteam," you lose all record of who did what.
Turn off the file editor in the dashboard so even a hijacked admin cannot edit theme files directly from the browser.

Handling a Volunteer Who Leaves on Bad Terms

It happens in every community eventually. When someone leaves angry, act within the hour: change their role to Subscriber, reset their password, and log them out of all sessions from their profile screen. Then check the last week of changes in your activity log for anything they edited. Doing this calmly and quickly matters more than whatever caused the split.

Frequently Asked Questions

Can an Author delete their own published posts?

Yes. Authors can edit and delete their own published posts. If you need to keep their work after they leave, change ownership to a staff account before you downgrade them.

How many Administrators should a small community site have?

Two is the sweet spot. One for daily work and a backup person in case the first is unreachable. More than three is almost always a sign of convenience beating security.

Do user roles affect site speed?

No. Roles are just permission checks and have no measurable effect on page loading. Plugins that add dozens of custom roles can slow the dashboard slightly, but visitors never notice.

Start With the Admin List Tonight

Open your Users screen, filter by Administrator, and count. If the number is higher than two, downgrade the extras before you go to bed. That single step closes the biggest hole on most fan sites. For more setup advice like this, browse our WordPress section.