Capabilities

What are capabilities?

Capabilities are WordPress permissions that effectively permit or deny users the ability to execute specific actions. Capabilities are assigned to roles, with user accounts automatically inheriting the capabilities assigned to the role they belong to. This allows the user to execute certain actions but not others.

Why are capabilities important on a WordPress website?

Every application, including WordPress, needs a system through which access to resources and functions is granted or denied. Capabilities offer a fine degree of control over which actions and functions we give access to any given user.

While this might not make much of a difference on smaller WordPress websites with a single user, its benefits become more apparent as the website grows, and with it the number of users that need access to WordPress. In such cases, leveraging the flexibility and power of WordPress roles can increase security and administrative efficiency.

How capabilities work

WordPress capabilities are assigned to roles. In turn, users are assigned to a role. Assigned capabilities give users who are members of the role the right to execute the action prescribed by the capability.

As an example, the delete_pages capability is assigned to the Editor role. We can then assign the Editor role to anyone who will carry out editorial work on our WordPress website. Let’s call him Fred. Since the delete_pages capability is assigned to the Editor role, of which Fred is a member, Fred can delete pages.

WordPress includes a number of capabilities that allow administrators to fine-tune the control they want to assign to roles. Plugins may also include their own sets of capabilities, allowing administrators to assign different capabilities to different roles – and by extension users.

The list of capabilities sees entries added and removed as new features are introduced and old ones retired. For the latest list, refer to the official WordPress roles and capabilities list.

How to manage capabilities on WordPress website

The best way to manage capabilities is through the principle of least privilege. This means that any given user should only be given access to the capabilities they need to perform their job. In some cases, this might require the creation of custom WordPress user roles to ensure you can assign just the capabilities the user needs.

Custom roles and capability assignments can be done through a third-party plugin such as User Role Editor. While this might not be necessary for a small team, bigger teams who might have more dedicated roles might find this finer degree of control especially useful.

It is equally important to ensure that access control mechanisms are in place to avoid any unauthorized access to roles and capabilities. One way to do this is through two-factor authentication on WordPress with the WP 2FA plugin. Two-factor authentication can stop over 99% of account-based attacks.