Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
To stop a WordPress role from creating posts, remove its post-creation capability—usually edit_posts—and test with an account assigned to that role. If users should still create drafts but not publish, remove publish_posts instead. If each user may create only a certain number of posts per day, month, or lifetime, use a quota tool; capability settings alone do not count posts.
Choose the type of limit you need
“Limit post creation” can describe three different policies. Select the policy before changing a role, because each uses a different control.
| Requirement | WordPress control | Typical setting |
|---|---|---|
| Users must not create any new posts | Role capability | Remove edit_posts from the affected role |
| Users may create drafts but cannot publish | Publishing capability | Remove publish_posts; the built-in Contributor pattern follows this model |
| Users may create a fixed number in a time period | Quota feature or plugin | Set a per-user or role limit and a daily, weekly, monthly, yearly, or lifetime cycle |
Removing a menu item or hiding the “Add New” button is not sufficient by itself. A user might still submit content through a front-end form, the REST API, an integration, or a custom post-type screen.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →How WordPress roles and capabilities control creation
WordPress roles are bundles of capabilities. A role determines which tasks its users can perform, and capabilities can be added or removed from that role. The built-in Contributor role can write and manage its own posts but cannot publish them; an Author can publish and manage its own posts.
#1 Best Overall
For ordinary Posts, edit_posts is the capability to examine first when the goal is to prevent a role from creating or editing posts. publish_posts is separate: it determines whether that role can publish posts. Do not remove the publishing capability when the actual requirement is to block draft creation, and do not assume that blocking publication also blocks drafting.
Block all new posts for a role
Use a capability editor
- Back up the site or make the change on staging.
- Open a role and capability editor such as PublishPress Capabilities, then select the role whose post access must change.
- Find the capabilities for the relevant post type and clear
edit_posts. Also review related capabilities such as editing published posts, deleting posts, and deleting published posts so the role retains only the duties it actually needs. - Save the role.
- Sign in with a test account assigned only to that role and check the dashboard, the direct post-new URL, any front-end submission form, and any integration used by the site.
The exact labels in a role editor vary by plugin and WordPress version. If the role is used for other content, removing a broad capability may affect more than the post screen, so review the resulting permissions before applying it to production.
Separate creation from publication
A role that cannot create posts normally has no new post to publish through the standard editor. Nevertheless, publication should be reviewed separately because content may be created by another route or by a custom workflow. Decide explicitly whether the role should have no post access, draft-only access, or publication access.
Recommended Free Tools
Allow drafts but prevent publishing
Keep the capability needed to write and manage drafts, but remove publish_posts for the relevant role. This mirrors the built-in Contributor model: contributors can write and manage their own posts but cannot publish them.
After saving, test both sides of the workflow. The test user should be able to open a new post, save a draft, and edit that draft, but should not be able to publish it. Check whether an editorial plugin, front-end form, or custom workflow has its own approval or publishing permission that must also be restricted.
Limit users to a number of posts
Capability settings are on/off permissions; they do not enforce “three posts per week” or “ten posts over a lifetime.” For a numeric limit, use a quota feature that records posts by user or role and applies a cycle.
User Posts Limit
The WordPress.org listing for User Posts Limit describes controls for selecting a role, post type, limit, and cycle. It advertises per-user limits with daily, weekly, monthly, yearly, and lifetime periods, plus integrations including the WordPress REST API.
Configure the quota for the specific post type and user population, then verify what counts: drafts, published posts, revisions, trashed posts, or only posts created during the active cycle. The listing describes the available settings, but behavior and compatibility can change; confirm the current plugin version and test on a staging copy with the site’s WordPress version and other submission tools.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Custom post types need their own check
A custom post type can be registered with a distinct capability mapping. Its creation permission may therefore be different from the permission used for ordinary Posts. Inspect the post type’s registration settings and identify the capability assigned to editing that type before changing a role.
Apply the restriction to the relevant post type, not just to the standard Posts capabilities. If a quota plugin is used, select the custom post type explicitly and test its editor and submission routes.
Check REST, front-end, and integration routes
WordPress post and page endpoints can perform capability checks such as edit_posts and edit_pages, but endpoints supplied by plugins or custom code may use different checks. A role change in the dashboard does not prove that every route is blocked.
- Try the standard dashboard “Add New” screen and its direct URL.
- Submit through each front-end or community form available to the role.
- Test the WordPress REST API route used by the site, including any application or automation account.
- Check custom post-type screens and endpoints.
- Review membership, editorial, and workflow plugins for separate permissions.
Use a non-administrator test account. Administrators or users with an additional role can retain capabilities and produce a misleading result.
Which approach fits which requirement?
| Approach | Best for | Limitations |
|---|---|---|
| Core role capability change | Blocking all creation for a role | Role-wide; does not count posts or create time-based quotas |
| Contributor-style permissions | Allowing drafts while requiring editorial publication | Does not impose a numeric creation limit |
| PublishPress Capabilities | Editing default role capabilities, including publishing, reading, editing, and deleting | Evidence supports role-level control, not per-user numeric quotas |
| PublishPress Permissions | More granular, content-specific permission requirements | More configuration than a simple role-wide block |
| User Posts Limit | Per-role or per-user counts over defined cycles | Third-party dependency; verify current compatibility and how the plugin counts content |
Verification and recovery checklist
- Define whether the policy is no creation, drafts only, or a quota.
- Record the original role capabilities before editing.
- Check ordinary Posts and every custom post type involved.
- Test dashboard, direct URLs, front-end forms, REST requests, and integrations.
- Use a test account with no administrator privileges or unexpected extra roles.
- Confirm that legitimate editors and administrators still have the access they need.
- If a workflow breaks, restore the recorded capability set or disable the quota rule, then retest one route at a time.
Important distinction: hiding controls versus enforcing access
Removing a menu item, hiding a button with CSS, or redirecting a screen improves the interface but is not an authorization control. Enforcement must occur through the role’s capabilities and, where applicable, the checks used by the site’s custom endpoints and quota mechanism.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
