- Article
- Intermediate
- 2 minutes read
- Reviewed August 4, 2026
WordPress roles group capabilities, while capabilities represent actions that a user can perform.
Secure access control checks capabilities at the point where an action or data request is processed.
Least Privilege
Give each user only the permissions required for their work.
An editor does not need plugin installation. A support user may need order access without full site administration.
Check Capabilities, Not Labels
Custom code should normally use current_user_can() with a capability relevant to the action.
Do not secure an action by:
- Hiding its menu.
- Checking only whether the user is logged in.
- Comparing a role name when a capability is more appropriate.
- Trusting a client-side interface.
- Checking a nonce without authorization.
Object-Level Authorization
Some capabilities depend on the specific object.
A user may edit their own post but not another author’s post. Pass the relevant object ID where WordPress expects it so meta-capability mapping can work.
Custom Roles and Post Types
Custom content can map its own capability set.
Plan singular and plural capabilities, administrative menus, REST endpoints and workflow states together.
Review Privileged Accounts
Audit:
- Administrators and Super Admins.
- Plugin-defined management roles.
- Application passwords.
- API credentials.
- Former staff.
- Dormant accounts.
- Network-level access.
- Database and hosting accounts.
Frequently Asked Questions
Is hiding a menu item access control?
No. The destination and action must enforce capabilities.
Should every administrator keep that role permanently?
No. Reduce privileges when the administrative task ends.
Continue Learning
Previous: [Two-Factor Authentication in WordPress](/resources/wordpress-manual/security/two-factor-authentication/)
Next: [HTTPS and Secure Connections](/resources/wordpress-manual/security/https-secure-connections/)