Creating Custom User Roles in WordPress
Custom Code Solution
This code creates a custom user role with specific capabilities. Place this code in your theme's functions.php
file or in a site-specific plugin:
Add a new custom role with basic capabilities:
function add_custom_role() {
add_role(
'custom_editor',
'Custom Editor',
array(
'read' => true,
'edit_posts' => true,
'delete_posts' => true,
'upload_files' => true,
'publish_posts' => true,
'edit_published_posts' => true,
'delete_published_posts' => true,
)
);
}
add_action('init', 'add_custom_role');
Remove the custom role (useful when deactivating theme/plugin):
function remove_custom_role() {
remove_role('custom_editor');
}
register_deactivation_hook(__FILE__, 'remove_custom_role');
Copy capabilities from an existing role to create a modified version:
function add_custom_role_from_existing() {
$editor = get_role('editor');
add_role(
'custom_editor_plus',
'Custom Editor Plus',
$editor->capabilities
);
// Add extra capabilities
$custom_role = get_role('custom_editor_plus');
$custom_role->add_cap('manage_categories');
$custom_role->add_cap('moderate_comments');
}
add_action('init', 'add_custom_role_from_existing');
Key Capabilities You Can Assign
Common capabilities you can use in your custom roles:
-
read
- View posts and pages
-
edit_posts
- Edit posts
-
publish_posts
- Publish posts
-
edit_pages
- Edit pages
-
publish_pages
- Publish pages
-
delete_posts
- Delete posts
-
upload_files
- Upload media files
-
edit_published_posts
- Edit already published posts
-
manage_categories
- Manage post categories
-
moderate_comments
- Moderate comments
-
manage_options
- Access settings pages
Plugin Solutions
If you prefer a plugin solution, these options are reliable:
-
Members - Free plugin with role editor
-
User Role Editor - Popular free plugin with extensive capabilities management
-
Capability Manager Enhanced - Advanced role management tool
Important Notes
- Always backup your database before modifying user roles
- Test new roles in a staging environment first
- Consider security implications when assigning capabilities
- Custom roles persist in the database even after theme/plugin deactivation unless explicitly removed
- Use
map_meta_cap
filter for fine-grained capability control
- Remember that some capabilities might require others to work properly
For maximum security, only assign capabilities that users absolutely need for their tasks.