What Is an Administrator in WordPress?

What an Administrator can do

An Administrator holds every capability WordPress offers on a single site. Some of those overlap with the Editor role:

• Publish, edit, and delete anyone’s posts and pages
• Moderate comments
• Upload files and manage categories

The rest belong to Administrators alone:

• Install, activate, update, and delete plugins and themes
• Update WordPress core
• Add, edit, and remove users
• Change site settings (the manage_options capability)
• Edit theme and plugin files
• Export and import content
• Customize the site’s design in the Site Editor (block themes) or the Customizer (classic themes)

The full capability-by-role breakdown is in WordPress.org’s Roles and Capabilities documentation.

Where Administrator sits in the role hierarchy

Below Administrator in the WordPress user role hierarchy sit Editor, Author, Contributor, and Subscriber, each with fewer capabilities than the one before it. The only role above Administrator is the Super Admin, which exists only on multisite networks.

Multisite also shrinks the role itself. On a network, updating WordPress core, installing or deleting plugins and themes, and creating or editing user accounts are reserved for the Super Admin. A site Administrator can still activate plugins the Super Admin has installed, switch themes, change existing users’ roles, and manage content and settings, but can’t touch the software itself.

Administrator vs. Editor

An Editor controls content and nothing else: they can publish, edit, and delete anyone’s posts and pages and moderate comments, but they can’t install plugins or themes, change site settings, or manage users. Give Editor to anyone who only manages content; reserve Administrator for whoever maintains the site itself.

Keep Administrator accounts to a minimum

A site needs only one Administrator account, and it’s wise to keep the number of Administrators as low as possible. Every extra Administrator account can install code, edit files, and create more admins, so each one widens the damage a stolen password can do.

Audit your accounts under Users > All Users and demote anyone who only writes or edits content to Editor. For a role-by-role walkthrough, read our guide to WordPress user roles.