Capabilities are the individual permissions a role is made of. Members lets you grant or deny any of them, but it doesn’t decide what each one does. WordPress, your theme, and your plugins do that. This page covers the ones people ask about most.
The one every role needs: read
Any role that should be able to log in and use the dashboard (even just to edit their own profile) needs the read capability. Without it, WordPress sends the user to your home page right after they log in, which looks like the login “didn’t work.”
Common WordPress capabilities
| Capability | What it allows |
|---|---|
read |
Use the dashboard and edit your own profile |
edit_posts |
Write and edit your own posts (drafts) |
publish_posts |
Publish your own posts |
edit_published_posts |
Edit your own posts after they’re published |
edit_others_posts |
Edit posts written by other people |
delete_posts |
Delete your own posts |
edit_pages, publish_pages, edit_others_pages |
The same as above, for pages |
upload_files |
Upload files and open the Media Library |
moderate_comments |
Approve, edit, and delete comments |
manage_categories |
Add and edit categories and tags |
edit_theme_options |
Menus, widgets, and the Customizer (and many theme settings screens) |
list_users |
See the Users list |
create_users, edit_users, delete_users |
Add, edit, and delete users |
promote_users |
Change users’ roles |
manage_options |
The Settings screens (and many plugins’ settings) |
activate_plugins, install_plugins |
Manage plugins |
Members adds a few of its own: restrict_content (use Content Permissions), list_roles, create_roles, edit_roles, and delete_roles.
Recipes
A writer who drafts but can’t publish. Grant read and edit_posts, and leave publish_posts unset. Their posts go to “Pending Review” for an editor to publish. This is how the built-in Contributor role works. Add upload_files if they need to add images.
Stop editing a post once it’s published. Leave edit_published_posts unset. The user can still write and edit drafts.
Someone who edits pages but not posts. Grant read, edit_pages, edit_others_pages, edit_published_pages, and publish_pages. Some page builders, like Elementor, also check edit_posts, so you may need that one too.
Manage menus. Menus need edit_theme_options. WordPress uses that same capability for widgets, the Customizer, and many theme settings screens, so it can’t be narrowed down to just menus with capabilities alone.
Media. upload_files covers both uploading and opening the Media Library; WordPress doesn’t split them. Uploaded files are posts behind the scenes, so editing or deleting someone else’s upload also needs edit_others_posts or delete_others_posts.
See users without changing them. Grant list_users only. Without edit_users, promote_users, and delete_users, the Users list is read-only.
Add users, but not administrators. create_users and promote_users let someone assign any role, including Administrator. To limit that, turn on the Role Hierarchy add-on so users can only assign roles below their own.
Custom post types
A custom post type uses whatever capabilities it was registered with:
- Most post types use the regular post capabilities, like
edit_posts. Anyone who can edit posts can edit them. - Some register their own, like
edit_eventsoredit_products. Those show up in Members as their own group, named after the post type, on the edit role screen.
If you build post types with Advanced Custom Fields, open the post type in ACF, go to Advanced Settings → Permissions, and turn on Rename Capabilities to give it its own capabilities. Then find them under Members → Roles.
Finding the capability another plugin needs
Every plugin decides which capability guards its screens. To find it:
- Look in Members first. Many plugins register their capabilities, and they appear in their own group on the edit role screen. Members also has integration add-ons for ACF, Easy Digital Downloads, GiveWP, Meta Box, and WooCommerce.
- Check the plugin’s documentation, or ask its author which capability a screen needs.
- Use a helper. The free Admin Menu Editor plugin shows the capability each admin menu item requires.
If a plugin uses manage_options, you can’t give access to just that plugin with capabilities, because manage_options also opens the WordPress Settings screens. A tool like Admin Menu Editor can hide the menus that role shouldn’t see.
Who can use the Members screens
| Screen or feature | Capability |
|---|---|
| Members → Add New Role | create_roles |
| Members → Roles (view) | list_roles |
| Edit a role | edit_roles |
| Delete a role | delete_roles |
| Export roles | list_roles |
| Import roles | edit_roles (plus create_roles to add new ones) |
| Content Permissions box on posts | restrict_content |
| Members → Settings and Add-Ons | manage_options |
Developers can change the Settings capability with the members_settings_capability filter.
Troubleshooting
A user can’t log in, or lands on the home page after logging in. Their role is missing read, or it denies capabilities it doesn’t need to. Check the role and remove unneeded denials.
“Add New” disappeared for posts or pages. If you turned on Core Create Caps, make sure the role has create_posts or create_pages.
A plugin’s menu disappeared for Administrators. The plugin added capabilities that the Administrator role doesn’t have yet. Grant them under Members → Roles → Administrator.
Changes keep reverting. Another plugin is resetting the role. See Role Management.
Locked yourself out? Use the Administrator Rescue Link.