WordPress Administrator: The Complete Guide for 2023

As a WordPress site owner, one of your most important responsibilities is controlling access to your site‘s back end. At the top of the user permissions hierarchy is the almighty Administrator role. Wielding godlike powers over your entire site, admins can quite literally make or break your WordPress install.

In this comprehensive guide, we‘ll unpack everything you need to know to master WordPress administrator management in 2023. I‘ll dive into admins‘ key capabilities, share best practices for securing admin accounts, and walk you through step-by-step how to add, remove, and edit administrator users. By the end, you‘ll be equipped with the knowledge and skills to confidently control admin access and keep your site safe. Let‘s get started!

What Is an Administrator in WordPress?

In WordPress, the administrator is the most powerful user role. Admins have unrestricted access to perform any action on a WordPress website, including:

• Creating, editing, and deleting all posts, pages, and media
• Installing, activating, and removing plugins and themes
• Modifying core WordPress files and code
• Managing all user accounts and controlling their roles
• Changing critical site settings like the site URL and name
• Upgrading WordPress core, plugins, and themes

Basically, administrators have complete control over every aspect of a WordPress website. They can make any change – even potentially destructive ones. With great power comes great responsibility!

Administrator Role Capabilities Explained

Let‘s geek out for a moment on the technical specifics of the WordPress administrator role. In the WordPress database, each user has a set of capabilities (or permissions) that define what actions they‘re allowed to perform. Admins are granted a massive collection of capabilities, including:

• manage_options: Allows access to all site administration features
• install_plugins and install_themes: Permits installation of new plugins and themes
• activate_plugins and switch_themes: Enables activating plugins or changing the site‘s theme
• edit_users and delete_users: Grants the ability to manage all user accounts
• unfiltered_html: Allows posting of unfiltered HTML content (a potential security risk)
• Many more granular permissions controlling content, settings, imports/exports, etc.

With dozens of administrator capabilities, admins can perform over 100 distinct actions in the WordPress back end. Other user roles have a smaller subset of capabilities. For example, Editors have edit_posts but not manage_options, while Subscribers only have read permissions.

Understanding Admin Limitations in Multisite

While administrators reign supreme on single WordPress sites, admins have reduced powers in multisite setups. In a WordPress multisite network, the Super Administrator role takes over some privileges normally reserved for admins:

• Network admins can‘t install plugins or themes (only Super Admins can)
• Admins can‘t access or change network settings
• Network site admins can only manage users on their site (not network-wide)

Super Admins delegate control of individual sites to administrators while retaining top-level control over the entire network. It‘s a sensible system of checks and balances!

WordPress Admin Statistics & Security Risks

To underscore the importance of carefully managing administrator users, let‘s look at some eye-opening WordPress statistics:

• 41% of hacked WordPress sites had an administrator account compromised (WPScan)
• Admin account breaches are the #1 cause of WordPress site hacks (Sucuri)
• The average WordPress site has 3 administrator accounts (WP White Security)
• "admin" is still the 4th most common WordPress username (WPScan)

These stats highlight why administrators are prime targets for hackers. A single compromised admin account can provide an attacker with complete control over a site. Brute force attacks on admin accounts are rampant, especially if you use a weak password.

To quantify the risk, WPScan detected over 124,000 WordPress brute force attacks in 2021. The Wordfence security plugin blocked an average of 4 million malicious login attempts per day in 2022! Needless to say, securing your admin account is critical.

WordPress Admin Security Best Practices

Now that you know the stakes, let‘s talk about how to keep your WordPress admin account locked down tight. Here are 10 administrator account security best practices every WordPress site owner should follow:

1. Choose a unique username (not "admin" or your name)
2. Use a strong, generated password with 12+ random characters
3. Implement two-factor authentication on admin accounts
4. Only log into wp-admin from trusted devices/networks
5. Keep WordPress core, plugins & themes updated to patch vulnerabilities
6. Install a WordPress security plugin to monitor for admin account breaches
7. Limit failed login attempts to block brute force attacks
8. Regularly delete inactive or unnecessary admin accounts
9. Monitor admin user activity logs for suspicious changes
10. Perform regular off-site backups in case of a worst-case hack

By putting these smart admin account security measures in place, you dramatically reduce the risk of falling victim to the most common WordPress hacks.

How to Add an Administrator in WordPress

If you‘ve weighed the risks and decided to grant someone else admin access, here‘s a step-by-step walkthrough of how to add an administrator in WordPress:

1. Log into your WordPress dashboard and navigate to Users > Add New
2. Fill in the new user‘s username, email address, first name and last name
3. Click the dropdown under "Role" and select "Administrator"
4. Under "Add New User" settings, choose whether to send the user an email notification
5. Click the "Add New User" button

6. Copy the new user‘s auto-generated password if shown. They will need this to log in for the first time.
7. Let them know they now have admin access. New admins will log in at yourdomain.com/wp-admin

After creating the new admin account, I recommend immediately prompting them to change their password to something strong and enabling two-factor authentication.

Deleting or Demoting a WordPress Admin

Sometimes admins leave your organization or no longer require full administrator permissions. In these cases, you‘ll want to either delete their account or demote them to a lower-access role like Editor.

To delete an admin account:

1. Log in as a WordPress administrator
2. Go to Users > All Users
3. Hover over the admin user you want to delete and click "Delete"
4. On the confirmation page, select what to do with the user‘s content (attribute to another user or delete) and click "Confirm Deletion"

Instead of deleting the user, you can also change their role to Editor, Author, Contributor, or Subscriber based on the level of access they need going forward. This will remove their admin capabilities but preserve their user account.

To change a user‘s role from Administrator to Editor:

1. Go to Users > All Users
2. Click the username of the Administrator you want to edit
3. Under the "Role" dropdown, select "Editor"
4. Click the "Update User" button

Carefully consider whether a user requires admin access, and promptly revoke it when they leave your team or change roles. Dormant admin accounts are a security risk.

Logging into the WordPress Admin Dashboard

Any user can log into their WordPress account at yourdomain.com/wp-admin. But when an administrator logs in, they are granted access to the full WordPress admin dashboard:

From the admin dashboard, you can:

• Create, edit or delete posts and pages
• Install and configure plugins or themes
• Customize your site‘s appearance
• Manage user accounts and moderate comments
• Change key site settings
• Run updates to WordPress core
• Access advanced tools like theme/plugin editors and import/export

Basically, think of the /wp-admin/ dashboard as your site‘s mission control center. Administrators have access to the full suite of controls, while lower user roles will see a more limited set of menu options based on their permissions.

To log out of the WordPress admin dashboard, click on your user avatar in the upper right corner of the toolbar and select "Log Out".

Wrapping Up: Mastering WordPress Administrator Management

Congratulations! You now understand the ins and outs of the WordPress administrator role. To recap:

• Administrators have unrestricted control over a single WP site
• With great power comes great responsibility (and hacking risk)
• Only grant admin access when absolutely necessary
• Vet admins carefully and revoke access when not needed
• Implement security best practices to lock down admin accounts
• Understand the process to add, delete, and edit administrator roles

By putting this knowledge into practice, you‘ll be able to harness the power of WordPress administrators while mitigating the inherent security risks they represent. Go forth and admin wisely!