Free WordPress User Role Plugin
Create and Manage Custom WordPress User Roles Safely
BBA User Role Manager gives WordPress administrators a clear, focused way to create custom user roles, manage selected capabilities, and review every registered role from one WordPress-native dashboard.
New roles begin with safe Subscriber-level access. WordPress core roles and roles created by other plugins remain protected and read-only.
Free and open source · No external services · No telemetry · Translation-ready
A safer way to manage WordPress roles
WordPress includes several default user roles, but many websites need more specific access levels—such as Event Organizer, Content Assistant, VIP Member, or Client.
BBA User Role Manager lets you create those roles without editing PHP or giving a broad permissions plugin control over every role on your website.
The plugin maintains a strict ownership boundary: it can manage roles created through its own interface, while WordPress core roles and third-party roles remain visible but protected.
Main features
Create custom user roles
Add a human-readable role name and a unique role key directly from the WordPress dashboard. No custom PHP snippets are required.
Safe permissions by default
Every new role starts with the current WordPress Subscriber capabilities, providing basic login access without automatically granting content-management or administrative permissions.
Manage selected capabilities
Enable or disable commonly used capabilities for posts, pages, media, categories, and selected site-management functions.
Review every registered role
View WordPress core roles, plugin-managed roles, and roles registered by other plugins in one organized directory.
Protect core and third-party roles
Administrator, Editor, Author, Contributor, Subscriber, and roles created by other plugins remain read-only.
Safely delete custom roles
When a plugin-managed role is deleted, users assigned to it are automatically moved to the Subscriber role.
WordPress-native administration
The interface follows familiar WordPress admin conventions and requires the manage_options capability.
Privacy-friendly
The plugin does not collect analytics, send telemetry, create external accounts, or transmit website data to third-party services.
Available capabilities
BBA User Role Manager provides a focused capability selection instead of exposing every capability registered on the site.
Post
- Create and edit own posts
- Publish own posts
- Edit other users’ posts
- Delete own posts
- Delete other users’ posts
- Read private posts
Pages
- Create and edit own pages
- Publish own pages
- Edit other users’ pages
- Delete own pages
- Delete other users’ pages
Media
- Upload media files
Categories and tags
- Manage categories and tags
Site management
- Edit theme options
- Manage site settings
Important: manage_options grants access to sensitive WordPress settings and should only be assigned to highly trusted users.
Who is this plugin for?
BBA User Role Manager is suitable for:
- Membership and community websites
- Editorial teams
- Client-managed WordPress websites
- Event and directory websites
- Small business websites
- Agencies creating limited client roles
- Websites that need a few focused custom roles
- Administrators who want visibility without modifying third-party roles
User documentation
Requirements
- WordPress 6.0 or newer
- PHP 7.4 or newer
- An administrator account with manage_options
Installation from WordPress
- Sign in to the WordPress dashboard.
- Go to Plugins → Add New Plugin.
- Search for BBA User Role Manager.
- Select Install Now.
- Select Activate.
- Open BBA User Role Manager from the WordPress admin sidebar.
Installation from ZIP
- Download the plugin ZIP.
- Open Plugins → Add New Plugin.
- Select Upload Plugin.
- Choose the ZIP file.
- Select Install Now.
- Activate the plugin.
Creating a custom role
- Open BBA User Role Manager.
- Find Add Custom User Role.
- Enter a display name, such as Event Organizer.
- Enter a role key, such as event_organizer.
- Select Add Role.
- Confirm that the role appears under Managed by this plugin.
Choosing a role key
Use a permanent, descriptive identifier:
- event_organizer
- content_assistant
- vip_member
- client_manager
Role keys should use lowercase letters, numbers, and underscores. Avoid names such as administrator, editor, or keys already registered by another plugin.
The display name can be changed in wording before creation, but the role key is its permanent technical identifier.
Managing capabilities
- Locate a role under Managed by this plugin.
- Select Manage Capabilities.
- Enable the capabilities the role needs.
- Leave unnecessary capabilities disabled.
- Select Save Capabilities.
- Test the role using a non-administrator test account.
Follow the principle of least privilege: grant only the permissions required for the user’s responsibilities.
Assigning the role to a user
- Open Users → All Users.
- Edit the intended user.
- Find the Role setting.
- Select the custom role.
- Save the user profile.
Always test the result with a separate account. Do not test permission changes using your primary administrator account.
Deleting a custom role
- Open BBA User Role Manager.
- Locate the plugin-managed role.
- Select Delete.
- Confirm the deletion.
Users assigned to the deleted role are moved to Subscriber automatically.
Understanding the role directory
The role table contains:
- Role Display Name: The user-facing name.
- Role Key: The permanent technical identifier.
- Source: WordPress core, BBA User Role Manager, or another source.
- Access: Whether the role is manageable or read-only.
- Actions: Available capability-management or deletion actions.
Source detection for third-party roles is informational. It does not grant ownership or permission to modify those roles.
Deactivation and uninstall behavior
Deactivation
Custom roles and plugin tracking information remain available. Reactivating the plugin restores normal management.
Uninstall
Uninstalling removes BBA User Role Manager’s tracking information but deliberately leaves custom WordPress roles in place to avoid unexpectedly disrupting users.
Back up your database before uninstalling if you may need to manage those roles again.
Limitations
- It does not modify WordPress core roles.
- It does not edit roles created by other plugins.
- It does not clone or rename existing roles.
- It exposes a focused capability list, not every capability registered by every plugin.
- It does not manage WooCommerce-specific or membership-plugin-specific capabilities.
- It does not provide network-wide multisite role synchronization.
- It does not assign multiple roles to one user.
- It does not replace a full enterprise permissions or policy-management system.
FAQs
A role is a collection of capabilities that controls what a user can do in WordPress. For example, a role may allow someone to edit posts without giving them access to site settings.
New roles inherit the current Subscriber capabilities. In a standard WordPress installation, this provides basic login and reading access without content-management permissions.
No. Administrator, Editor, Author, Contributor, and Subscriber are protected from modification and deletion.
No. Third-party roles are shown for visibility but remain read-only. This prevents BBA User Role Manager from taking ownership of another plugin’s data.
Not through the current interface. The plugin exposes a focused list of common WordPress capabilities.
Every plugin-created role retains the basic read capability so assigned users can sign in.
The current version does not provide role renaming. Choose the display name and role key carefully before creation.
No. Every role key must be unique across WordPress and all installed plugins.
The role is removed, and users currently assigned to it are reassigned to Subscriber.
No. WordPress roles remain stored in the site database after deactivation.
The plugin removes its tracking options but leaves the custom WordPress roles intact to avoid unexpectedly breaking assigned users.
Only users with the manage_options capability—normally administrators—can access or change plugin settings.
No. It does not include telemetry, analytics, external API calls, or user tracking.
No. The plugin works in the WordPress administration area and does not add frontend output.
Yes. User-facing strings use the published builtbyamit-user-role-manager text domain, and the plugin includes a POT translation template.
It does not provide dedicated network-wide role synchronization. Roles should be managed within the relevant individual site.
That capability provides access to sensitive site settings. Grant it only to fully trusted users who effectively require administrator-level settings access.
Use the official WordPress.org support forum.
Create focused WordPress roles without editing code
Give team members the access they need while keeping WordPress core and third-party roles protected.
Free, open source, and available from WordPress.org.