User roles and permissions in Wordpress - Step-by-Step Execution

Concept Flow - User roles and permissions

Define Roles

↓

Assign Capabilities

↓

Create Users

↓

Assign Roles to Users

↓

User Logs In

↓

Check User Role & Permissions

↓

Allow or Deny Actions

This flow shows how WordPress defines roles, assigns capabilities, creates users, and checks permissions when users perform actions.

Execution Sample

Wordpress

<?php
// Add a custom role
add_role('custom_editor', 'Custom Editor', ['edit_posts' => true, 'delete_posts' => false]);

// Assign role to user
$user = new WP_User($user_id);
$user->set_role('custom_editor');

// Check capability
if(current_user_can('edit_posts')) {
  // Allow editing
}

This code adds a custom role, assigns it to a user, and checks if the user can edit posts.

Execution Table

Step	Action	Role/Capability State	User Role	Permission Check	Result
1	Define 'custom_editor' role with 'edit_posts' capability	Roles: custom_editor(edit_posts: true, delete_posts: false)	None	N/A	Role created
2	Create user object for user_id	Roles unchanged	None	N/A	User object ready
3	Assign 'custom_editor' role to user	Roles unchanged	custom_editor	N/A	User role set
4	User tries to edit post	Roles unchanged	custom_editor	Check 'edit_posts'	Allowed (true)
5	User tries to delete post	Roles unchanged	custom_editor	Check 'delete_posts'	Denied (false)
6	User tries to publish post (not assigned)	Roles unchanged	custom_editor	Check 'publish_posts'	Denied (false)

💡 Permissions checked for user actions; allowed or denied based on role capabilities.

Variable Tracker

Variable	Start	After Step 1	After Step 3	After Step 4	After Step 5	Final
Roles	None	{custom_editor: {edit_posts: true, delete_posts: false}}	{custom_editor: {edit_posts: true, delete_posts: false}}	{custom_editor: {edit_posts: true, delete_posts: false}}	{custom_editor: {edit_posts: true, delete_posts: false}}	{custom_editor: {edit_posts: true, delete_posts: false}}
User Role	None	None	custom_editor	custom_editor	custom_editor	custom_editor
Permission Check	N/A	N/A	N/A	edit_posts: true	delete_posts: false	publish_posts: false

Key Moments - 3 Insights

Why can the user edit posts but not delete them?

Because the 'custom_editor' role has 'edit_posts' set to true but 'delete_posts' set to false, as shown in execution_table rows 4 and 5.

What happens if a capability is not assigned to a role?

The capability defaults to false, so the user cannot perform that action, as seen in step 6 where 'publish_posts' is not assigned.

Does assigning a role to a user change the role's capabilities?

No, assigning a role to a user only links the user to that role; the role's capabilities remain unchanged (see variable_tracker for Roles).

Visual Quiz - 3 Questions

Look at the execution_table at step 4. What permission does the user have?

A Can edit posts

B Can delete posts

C Can publish posts

D No permissions

💡 Hint

Check the 'Permission Check' and 'Result' columns at step 4 in execution_table.

At which step is the user assigned the 'custom_editor' role?

A Step 1

B Step 2

C Step 3

D Step 4

💡 Hint

Look at the 'User Role' column in execution_table to see when it changes from None.

If 'delete_posts' was set to true in the role, what would change in the execution_table?

A Step 4 result would be Denied

B Step 5 result would be Allowed

C User role would change

D No change

💡 Hint

Compare the 'Permission Check' and 'Result' columns for step 5.

Concept Snapshot

WordPress User Roles & Permissions:
- Roles group capabilities (actions users can do).
- Assign roles to users to grant permissions.
- Use add_role() to create roles with capabilities.
- Use current_user_can() to check permissions.
- Unassigned capabilities default to denied.

Full Transcript

In WordPress, user roles define what actions users can perform by grouping capabilities. First, roles are created with specific capabilities like editing or deleting posts. Then, users are assigned these roles. When a user tries to do something, WordPress checks if their role has the needed capability. If yes, the action is allowed; if not, it is denied. This system helps control access easily by managing roles instead of individual permissions for each user.

Practice

1. What is the main purpose of user roles in WordPress?

easy

A. To group permissions and control what users can do

B. To change the website's theme

C. To add new plugins automatically

D. To backup the website data

Solution

1. Step 1: Understand the concept of user roles

   User roles in WordPress are designed to group permissions for users.

2. Step 2: Identify the purpose of roles

   Roles control what actions users are allowed to perform on the site.

3. Final Answer:

   To group permissions and control what users can do -> Option A

4. Quick Check:

   User roles = group permissions [OK]

Hint: Roles group permissions to control user actions [OK]

Common Mistakes:

• Confusing roles with themes or plugins
• Thinking roles backup data
• Assuming roles add new features automatically

2. Which function is used to add a new user role in WordPress?

easy

A. add_user_role()

B. add_role()

C. create_role()

D. new_role()

Solution

1. Step 1: Recall WordPress role functions

   The correct function to add a new role is add_role().

2. Step 2: Verify function names

   Other options like add_user_role() or create_role() do not exist in WordPress core.

3. Final Answer:

   add_role() -> Option B

4. Quick Check:

   Adding roles = add_role() [OK]

Hint: Use add_role() to create new roles [OK]

Common Mistakes:

• Using add_user_role() which is not a WordPress function
• Confusing with create_role() or new_role()
• Trying to add roles without this function

3. What will the following code output if the current user has the 'edit_posts' capability?

if (current_user_can('edit_posts')) {
  echo 'Can edit posts';
} else {
  echo 'Cannot edit posts';
}

medium

A. Cannot edit posts

B. Syntax error

C. No output

D. Can edit posts

Solution

1. Step 1: Understand current_user_can() behavior

   This function checks if the current user has a specific capability.

2. Step 2: Analyze the condition

   If the user has 'edit_posts', the code echoes 'Can edit posts'.

3. Final Answer:

   Can edit posts -> Option D

4. Quick Check:

   Has capability = prints confirmation [OK]

Hint: current_user_can() returns true if user has capability [OK]

Common Mistakes:

• Assuming it returns false always
• Confusing capability names
• Expecting syntax errors from correct code

4. Identify the error in this code snippet for removing a user role:

remove_role('editor');

medium

A. remove_role() requires two parameters

B. remove_role() cannot remove default roles

C. No error, this code correctly removes the 'editor' role

D. The role name must be capitalized

Solution

1. Step 1: Check remove_role() usage

   The function remove_role() takes one parameter: the role slug. This usage is correct.

2. Step 2: Verify default roles behavior

   WordPress allows removing default roles like 'editor' using remove_role(). The code executes without error, though default roles may be re-registered later.

3. Final Answer:

   No error, this code correctly removes the 'editor' role -> Option C

4. Quick Check:

   remove_role() works on all roles [OK]

Hint: remove_role('editor') works fine [OK]

Common Mistakes:

• Thinking remove_role needs two parameters
• Believing default roles cannot be removed
• Assuming role names must be capitalized

5. You want to create a custom role 'content_manager' that can edit posts and moderate comments. Which code snippet correctly adds this role with these capabilities?

hard

A. add_role('content_manager', 'Content Manager', ['edit_posts' => true, 'moderate_comments' => true]);

B. add_role('content_manager', 'Content Manager', ['edit_posts', 'moderate_comments']);

C. add_role('content_manager', 'Content Manager', ['edit_posts' => false, 'moderate_comments' => true]);

D. add_role('content_manager', 'Content Manager', ['edit_posts' => true, 'delete_posts' => true]);

Solution

1. Step 1: Understand add_role() parameters

   The function takes role slug, display name, and an array of capabilities with boolean values.

2. Step 2: Check capabilities array

   Capabilities must be keys with true/false values to grant or deny permissions.

3. Step 3: Match required capabilities

   Only add_role('content_manager', 'Content Manager', ['edit_posts' => true, 'moderate_comments' => true]); correctly grants 'edit_posts' and 'moderate_comments' as true.

4. Final Answer:

   add_role('content_manager', 'Content Manager', ['edit_posts' => true, 'moderate_comments' => true]); -> Option A

5. Quick Check:

   Capabilities array with true values = correct role setup [OK]

Hint: Capabilities array needs keys with true/false values [OK]

Common Mistakes:

• Passing capabilities as list without keys
• Setting capability to false when it should be true
• Adding wrong capabilities not requested