WooCommerce user roles determine what each account can see and do in a store. WordPress supplies the underlying role-and-capability system; WooCommerce adds the Customer and Shop Manager roles for commerce tasks. The safest setup is to assign the least-powerful role that lets a person complete their work, then audit the individual capabilities behind that role.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
How WooCommerce roles and capabilities work
WordPress defines a role as a bundle of permissions called capabilities. A role name is only a container. WordPress or a plugin checks individual capabilities before allowing an action, such as editing a product, viewing an order, changing a setting or managing users.
As an Amazon Associate I earn from qualifying purchases.
That distinction matters when you create a custom role or troubleshoot access. Two roles with different names may contain similar capabilities, while two users with the same role can have different access if another plugin adds or removes permissions. WordPress describes roles and capabilities as the mechanisms used to control user privileges, and its security guidance expects plugins that accept user-submitted data to check capabilities rather than trust a displayed role name.
WordPress core includes Super Admin, Administrator, Editor, Author, Contributor and Subscriber. WooCommerce adds Customer and Shop Manager. Marketplace or multi-vendor extensions can add their own roles, such as Vendor Admin and Vendor Manager; the extension’s configuration determines what those accounts can do.
#1 Best Overall
WooCommerce roles at a glance
| Role | Where it comes from | Typical purpose | Store operations | Site-wide settings and content | User administration |
|---|---|---|---|---|---|
| Administrator | WordPress core | Trusted site owner or maintainer | Full WooCommerce access | Broad control of configuration, plugins, themes and content | Can administer users and roles |
| Shop Manager | WooCommerce core | Day-to-day store operator | Catalog, orders, customers and reports | Less WordPress-wide control than Administrator | Selected user-related capabilities; not automatically full user administration |
| Customer | WooCommerce core | Ordinary shopper account | Can use customer-facing account and checkout features | No routine administrative access | No staff user-management access |
| Subscriber | WordPress core | Minimal WordPress account | Not a WooCommerce staff role | Usually limited to reading and profile management | No staff user-management access |
| Editor | WordPress core | Content editor | Not a substitute for Shop Manager | Can manage site content within WordPress’s content model | Not a WooCommerce operations role |
| Author or Contributor | WordPress core | Content creation workflow | Not a substitute for Shop Manager | Post-writing permissions vary by role | Not a WooCommerce operations role |
| Vendor Admin or Vendor Manager | Vendor extension | Multi-vendor marketplace participant | Depends on the vendor extension | Usually limited to vendor scope, but exact capabilities vary | Depends on extension configuration |
What each major role should be used for
Administrator
An Administrator has broad control over one WordPress site, including site configuration and user administration. That can include changing plugins, themes, security settings, payment integrations and other controls outside WooCommerce.
Reserve this role for a trusted owner or maintainer who genuinely needs site-wide control. Giving an order processor or product editor Administrator access exposes unrelated settings and creates a larger blast radius if the account is compromised. If a person only needs to manage products and orders, start with Shop Manager or a narrower custom role.
Recommended Free Tools
Shop Manager
Shop Manager is WooCommerce’s operational role. It is intended for staff who maintain the catalog, process orders, work with customers and use store reports without receiving the full WordPress-wide authority of an Administrator.
WooCommerce documents capabilities associated with this role, including manage_woocommerce, create_customers and list_users. These are separate checks, not one master switch. A role having manage_woocommerce does not automatically make every user-management action available or make the role able to edit any account.
Before assigning Shop Manager, verify whether the employee should see all customer data, refunds, reports, downloadable files, tax settings or payment-related configuration. If the answer is no for some of those areas, use a custom role or capability restrictions rather than assuming the standard role is sufficiently narrow.
Customer
Customer is the normal WooCommerce shopper role. It supports the account and checkout experience rather than store administration. In common WooCommerce flows, newly registered shoppers receive this role, although registration settings and extensions can change the behavior.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →A Customer account should not be used for staff simply because it is low privilege. It lacks the operational capabilities needed to manage products, orders or reports.
Subscriber
Subscriber is a WordPress role with minimal profile and reading access. It is distinct from Customer even though both are low-privilege roles. A Subscriber is not automatically treated as a WooCommerce shopper, and a Customer is not automatically a WordPress content subscriber.
Choose between them based on the account’s purpose: Customer for a WooCommerce shopping account, Subscriber for a basic WordPress account that needs little more than profile access.
Editor, Author and Contributor
These roles are built around WordPress content. Their capabilities concern posts, pages and editorial workflows, not WooCommerce operations. Assigning Editor, Author or Contributor will not reliably give someone the product, order, customer or reporting access that a store employee needs.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsVendor roles
Multi-vendor extensions may provide Vendor Admin and Vendor Manager roles. Their permissions are extension-specific: one installation might restrict a vendor to its own products, while another might expose additional order or reporting functions. Inspect the extension’s actual capabilities and test the vendor workflow before granting access to a production account.
How to assign a role safely
- Define the tasks. Write down exactly what the person must do: edit products, fulfill orders, issue refunds, view reports, create customers, publish content or manage users. Avoid starting with a role name.
- Start with the least powerful option. For shoppers, use Customer. For routine store operations, evaluate Shop Manager. For specialized work, use a custom role containing only the capabilities required.
- Inspect capabilities. Review capabilities supplied by WooCommerce and any extensions. Pay particular attention to permissions that expose customer data, alter prices, issue refunds, change payment settings or manage other accounts.
- Create or edit the account. In the WordPress dashboard, use Users → Add New for a new account or Users → All Users to edit an existing one, then select the intended role and save. If your site uses a role-management extension, confirm that it has not added extra capabilities to the selected role.
- Test both allowed and blocked actions on staging. Sign in as the test user and verify the required workflow. Also try actions the user must not perform, such as changing plugins, editing another user’s role or opening restricted settings.
- Review after updates. WooCommerce and extensions can add, remove or change capability checks. Re-test custom roles after updates, especially when the store relies on filters or vendor extensions.
Shop Manager and user editing in WooCommerce 11.2.0
WooCommerce 11.2.0 changed a specific default behavior: a Shop Manager can edit a user whose only assigned role is Customer. The woocommerce_shop_manager_editable_roles filter changes the allowlist of roles that Shop Managers may edit.
Rank #2
For a user with multiple roles, every role assigned to that user must be allowed by the filter. If even one role is outside the allowlist, the edit operation is not permitted under that rule.
The filter does not grant WordPress user-management capabilities by itself. It only changes which role combinations are considered editable by this WooCommerce behavior. A Shop Manager still needs the relevant capability checks, and a role with manage_woocommerce alone is not automatically authorized to edit users.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWhen limiting Shop Manager access, evaluate the complete chain: the user’s assigned roles, the capabilities those roles contain, the allowlist returned by the filter and any additional plugin checks. Test a single-role Customer account and a multi-role account separately.
Creating a custom WooCommerce role
A custom role is appropriate when the standard roles are either too powerful or too limited. Examples include a fulfillment employee who needs order status and shipping information but not product pricing, a catalog assistant who can edit products but not issue refunds, or a support agent who can view selected customer information without changing store settings.
Design the role by capability
- List each required action, not just the screen the person should see.
- Map the action to the capability checked by WooCommerce or the relevant extension.
- Exclude settings, export, refund, payment and user-management capabilities unless they are essential.
- Check whether a plugin adds capabilities that expose more data than the role’s name suggests.
Audit the result
Role names can be misleading, so inspect the resulting capability set. A custom role should be documented with its purpose, owner, included capabilities and review date. Keep a copy of the intended capability list so an update can be compared against the approved design.
Test failure paths
Do not stop after confirming that the employee can complete a task. Attempt blocked actions: opening restricted settings, exporting customer data, changing another user’s role, editing products outside the intended scope and performing refunds. A hidden menu is not proof of security; the server-side capability check must deny the action as well.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Registration settings and role selection
WooCommerce account settings can assign a default role to new registrants, display a restricted role selector and restrict selected pages by role. Keep self-selection limited to roles that are safe for untrusted visitors. A public registration form should never let an unknown visitor choose Administrator, Shop Manager or a privileged custom role.
For higher-risk workflows, use approval controls rather than open self-registration. A vendor application, wholesale account or staff invitation should be reviewed before the account receives capabilities that expose business or customer data. Check the final role after registration because an extension may alter the default or add another role.
REST API role filters are not authorization
The WooCommerce REST customers endpoint supports role filters for administrator, editor, author, contributor, subscriber, customer and shop_manager. A role filter selects which records are returned; it does not grant permission to read or modify them.
Authentication and capability checks still decide whether an API request is authorized. An integration should use credentials belonging to an account with only the capabilities it needs, protect those credentials, and verify that denied requests fail as expected. Filtering for Customer records is not a substitute for restricting access to customer data.
Free tools Windows power users keep installed
One-click scans. No signup required.
WooCommerce.com collaborators are separate accounts
Permissions granted to collaborators in a WooCommerce.com account are separate from WordPress roles on the store itself. An account owner can grant access to areas such as Downloads, Subscriptions, Connected Sites, Orders and Support. Collaborators cannot access stored payment details.
Giving someone WooCommerce.com collaborator access therefore does not make that person a Shop Manager or Administrator in the WordPress dashboard. Configure both systems independently and remove access in both places when a contractor or employee leaves.
Common mistakes and fixes
Giving Administrator access for convenience
Problem: A staff member receives unrestricted site settings, plugins and user administration to solve a store task.
Fix: Reproduce the task with Shop Manager or a custom capability set, then test the denied actions. Keep Administrator for trusted maintainers who need the additional authority.
Assuming a role name tells the whole story
Problem: A custom role appears harmless, but an extension has added export, refund or user capabilities.
Fix: Audit capabilities directly and document changes made by plugins or updates.
Confusing Customer with Subscriber
Problem: A WordPress account is assigned Subscriber and does not behave like a WooCommerce shopper, or a shopper is treated as a content subscriber.
Fix: Use Customer for the WooCommerce account workflow and Subscriber for minimal WordPress access, unless a documented extension requires another arrangement.
Assuming Shop Manager can edit every user
Problem: A Shop Manager can edit some Customer accounts but not a user with several roles.
Fix: Check the woocommerce_shop_manager_editable_roles allowlist and confirm that every role on the target account is permitted. Then verify the separate WordPress capability checks.
Relying on hidden menus
Problem: An item is absent from the dashboard, but a direct request or API call still succeeds.
Fix: Test the underlying action and endpoint with the restricted account. Access control must be enforced by capability checks, not only by hiding navigation.
A practical decision framework
- Shopper: Customer, unless registration settings or an extension intentionally require another role.
- Basic WordPress reader: Subscriber.
- Content-only worker: Editor, Author or Contributor, selected according to the publishing workflow.
- Day-to-day store operator: Shop Manager, after checking data exposure and user-management requirements.
- Specialized staff member: A custom role built and audited by capability.
- Site owner or technical maintainer: Administrator, limited to people who genuinely need site-wide control.
- Marketplace vendor: The vendor role supplied by the extension, with its capabilities verified in staging.
Revisit the decision whenever responsibilities change, a new extension is installed or WooCommerce is updated. The correct role is the smallest capability set that supports the person’s current duties, not the most convenient label.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
