Give people and integrations only the access their work requires.
A role name is a bundle, not a job description. Least privilege means a person, service, or integration receives the capabilities needed for current work, for the required duration, with a reviewable owner.
Inventory identities before editing roles
Export or list users, service accounts, application passwords, API keys, OAuth connections, command-line access, hosting access, and identity-provider groups. Mark owner, purpose, last confirmed use, authentication method, and recovery contact. Do not delete an unknown identity until its use is understood.
Translate jobs into actions
Interview the people doing the work. “Store manager” may mean refund orders but not install plugins; “editor” may publish one post type but not export users. Write tasks as verbs and objects, then map them to capabilities in a test site.
| Job need | Capability questions | Boundary to test |
|---|---|---|
| Publish articles | Create, edit, publish, delete; own vs others’ content? | No plugin, theme, user, or settings access |
| Process orders | View, update status, refund, export? | No gateway keys or site administration |
| Support customers | Which customer/order fields are necessary? | No bulk export or unrelated private content |
| Maintain site | Updates, code, cache, logs, backups? | Separate routine maintenance from user administration |
| Integrate service | Read/write which endpoints and records? | No interactive login; scoped, rotatable credential |
Test the effective permission, not the settings screen
Plugins can add capabilities, custom post types, REST routes, and admin pages. A visually hidden menu does not prove access is blocked. Sign in as a test user for each role and attempt direct URLs, REST actions, media access, exports, bulk actions, order notes, refunds, settings changes, and cross-account records.
Separate high-impact duties
- Keep plugin/theme installation and code editing away from routine publishing.
- Limit user and role administration to a small accountable group.
- Separate order handling from payment-key or payout administration where practical.
- Use individual accounts; do not share an administrator login.
- Give integrations non-human credentials and only the endpoints they need.
- Use temporary elevation for rare tasks when the environment supports it.
Review authentication and recovery
Require strong unique credentials and multi-factor authentication for privileged accounts. Protect the email and hosting accounts that can reset WordPress. Remove unused application passwords and sessions. Confirm that emergency access is documented, protected, and tested without becoming a permanent shared backdoor.
Run a recurring access review
- Confirm every identity with its owner.
- Remove or disable departures and expired vendors through an approved process.
- Compare capabilities with current tasks.
- Inspect newly added capabilities after plugin changes.
- Rotate scoped credentials according to risk and provider guidance.
- Review administrator actions and unexpected role changes.
- Record approver, evidence, exceptions, and next review date.
Prepare for urgent administration without permanent excess
Document how an authorized maintainer receives temporary elevation during an incident, how another person approves or observes the change, and how access is removed afterward. Keep hosting, database, and command-line recovery separate from ordinary WordPress administration. Test the recovery path during a calm window, then protect the recovery record like any other privileged credential.
After a security or availability incident, review which powers were actually used. A temporary exception should expire by design; do not let an urgent administrator account become an unowned permanent identity.
Before adding a role-management extension, apply the plugin evaluation process. Include the role matrix in the checkout troubleshooting runbook because access changes can affect orders, refunds, and integrations.
Sources and further reading
Primary and contextual sources used to verify definitions or give readers a relevant next resource.
- WordPress roles and capabilities Official definitions of core roles and capabilities.