iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
WooCommerce user roles are bundles of WordPress capabilities that determine what a person can see and do in a store. WooCommerce adds the Customer and Shop Manager roles to WordPress’s core roles, while extensions may add vendor or marketplace roles. Choose the least-powerful role that supports the person’s work, then verify the individual capabilities rather than trusting the role name alone.
What WooCommerce roles are and why capabilities matter
WooCommerce uses WordPress’s role-and-capability system. A role is a named bundle of permissions; a capability is one permission checked by WordPress or a plugin. For example, a role might include manage_woocommerce for store administration, create_customers for creating customer records, or list_users for viewing users.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →
The name shown in the Users screen is therefore only a container. Two roles with different names can have overlapping capabilities, and a plugin can add or remove capabilities from an existing role. Security decisions should be based on the actual capability list and on the checks made by the relevant plugin. WordPress’s Developer Handbook summarizes the model this way: “Roles and capabilities are two important aspects of WordPress that allow you to control user privileges.”
WordPress core supplies Super Admin, Administrator, Editor, Author, Contributor and Subscriber. WooCommerce supplies Customer and Shop Manager. Marketplace or vendor extensions can register additional roles, such as Vendor Admin and Vendor Manager; their permissions depend on that extension’s configuration.
#1 Best Overall
WooCommerce and WordPress roles compared
| Role | Where it comes from | Typical access | Main risk or limitation |
|---|---|---|---|
| Super Admin | WordPress multisite | Network-wide administration, including sites, users and network settings | More powerful than a single-store Administrator; reserve for the network owner |
| Administrator | WordPress core | Broad control of one site, including configuration, plugins, themes and user administration | Can change security-sensitive settings or grant further access |
| Shop Manager | WooCommerce core | Day-to-day catalog, orders, customers and reports, with less WordPress-wide control than Administrator | Still exposes operational and customer data; exact capabilities can change with extensions |
| Customer | WooCommerce core | Shopper account functions such as viewing their own orders and managing their profile | Not a staff role; registration settings or extensions can alter the default behavior |
| Subscriber | WordPress core | Minimal profile and read access | Not interchangeable with Customer; it does not represent a WooCommerce shopper by itself |
| Editor | WordPress core | Manage posts and pages, including other authors’ content | Content authority does not provide WooCommerce operations |
| Author | WordPress core | Create and publish the user’s own posts | No standard store-management authority |
| Contributor | WordPress core | Write posts for review, without publishing them | No standard store-management authority |
| Vendor Admin or Vendor Manager | Vendor or marketplace extension | Vendor-specific products, orders or settings defined by that extension | Capabilities vary; audit the extension’s documentation and configuration |
The table describes the usual purpose of each role, not a guarantee that every installation behaves identically. Plugins, multisite settings and custom code can change capability assignments or add new checks.
What each important role can do
Administrator
An Administrator has broad control over a single WordPress site. That normally includes site configuration and user administration in addition to WooCommerce management. An Administrator can often install or configure plugins and themes, alter security settings and assign roles, so this access should be limited to a trusted owner or maintainer who genuinely needs site-wide control.
Shop Manager
Shop Manager is WooCommerce’s operational staff role. It is intended for people who need to maintain products, process orders, work with customers and read store reports without receiving the full WordPress-wide authority of an Administrator. WooCommerce documents capabilities associated with this work, including manage_woocommerce, create_customers and list_users.
Those capabilities are independent checks. Possessing manage_woocommerce does not automatically make a role able to edit users, and seeing a user list does not by itself authorize every user-management action. Extensions can also add their own capabilities and screens to the role.
Customer
Customer is the normal WooCommerce role for a shopper account. In common WooCommerce flows, a newly registered buyer receives this role and can access their own account and order information. The exact result depends on WooCommerce registration settings and any extension that handles registration or approvals, so confirm the setting on the site rather than assuming every registration path behaves the same way.
Subscriber, Editor, Author and Contributor
These are WordPress content roles, not alternatives to Shop Manager. Subscriber is a low-privilege profile/read role, while Editor, Author and Contributor govern posts and other content workflows. Assigning one of them will not, by itself, provide the catalog, order or reporting capabilities needed for store operations.
Vendor roles
Vendor Admin and Vendor Manager are examples of roles supplied by a product-vendor extension. One installation might allow a vendor to manage only their own products; another might expose vendor orders, commissions or settings. Do not infer their scope from the label. Read the extension’s capability list and test access with a vendor account.
How to assign a role safely
Use this workflow whenever you create a staff account, change an existing account or install an extension that adds permissions.
- Write down the person’s tasks. Separate catalog editing, order fulfillment, refunds, customer support, reporting, content publishing and site administration. Avoid granting a broad role simply because it is convenient.
- Start with the least-powerful built-in role. Customer is for shoppers; Shop Manager is the normal starting point for operational staff; Administrator is reserved for genuine site-wide needs. A content role is appropriate only when the work is editorial.
- Inspect capabilities. Review the role’s capabilities, including capabilities added by WooCommerce and other plugins. Pay particular attention to user-management, settings, payment, export and data-deletion permissions.
- Create or edit the account. In WordPress, open Users, choose Add New or open an existing user, select the intended role and save. If the account needs more than one role, document why each role is present.
- Test on staging first. Sign in as the test user and verify the exact tasks they must perform. Then try sensitive actions they must not perform, such as changing plugins, editing other users, altering checkout settings or viewing unrelated data.
- Review after updates. Recheck the role after WooCommerce, WordPress or an extension update. Capability sets and permission checks can change, especially when a plugin introduces new screens or custom capabilities.
Keep an inventory of staff accounts, assigned roles, business owners and last review dates. Remove unused accounts and downgrade temporary access when the task is complete.
Rank #2
Shop Manager user-editing behavior in WooCommerce 11.2.0
WooCommerce 11.2.0 allows a Shop Manager to edit a user whose only assigned role is Customer by default. This behavior is controlled by the woocommerce_shop_manager_editable_roles filter, which changes the allowlist of roles that Shop Manager can edit.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- If a user has multiple roles, every assigned role must be allowed for the edit to be permitted.
- The filter changes which role combinations are editable; it does not grant WordPress user-management capabilities by itself.
- Capabilities such as
list_users,manage_woocommerceandcreate_customersremain separate checks.
Before changing this filter in production, test the complete account lifecycle on staging: locating a user, opening the profile, changing permitted fields, changing a role and saving the result. A filter adjustment can make an account visible without granting every action the staff member expects.
How to limit Shop Manager access
Use a narrower role when the job is narrow
If a staff member only handles fulfillment or support, a custom role containing the required order and customer capabilities may be safer than the full Shop Manager bundle. Build from a documented task list, then add only the capabilities needed for those tasks. Avoid copying Administrator capabilities into a “limited” role; that creates a role with a misleading name and excessive authority.
Audit capabilities added by extensions
Payment, subscriptions, marketing, shipping, analytics and vendor extensions may add their own capabilities. A Shop Manager who was safe before an extension was installed can gain access to new data or settings afterward. Review the role again whenever a plugin is added, removed or reconfigured.
Verify blocked actions, not just successful ones
Permission mistakes are often discovered only when a user reaches a sensitive screen. Test direct URLs as well as menu visibility, because hiding a menu item is not the same as denying the underlying capability. Check exports, refunds, payment configuration, user profiles, plugin settings and customer personal data according to the store’s risk profile.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Creating a custom WooCommerce role
A custom role is appropriate when built-in roles are either too powerful or too limited. The role should be defined by capabilities, not by a job title.
- Map tasks to screens and actions. For example, “update shipment status” is more precise than “manage orders.” Include create, read, edit, delete, export and configuration actions separately.
- Identify the capability each action checks. Use the extension’s documentation and a staging test to confirm the check. Similar-looking screens may require different capabilities.
- Copy the smallest suitable baseline. Start from a low-privilege role or an empty custom role where your role-management method supports it. Remove unrelated capabilities rather than inheriting broad site administration.
- Test positive and negative cases. Confirm that required actions work and that prohibited actions fail with an appropriate denial or redirect.
- Document ownership and maintenance. Record why each capability exists, who approved it and which plugin provides it. Re-test after updates because capability names and checks can change.
Use a maintained role-and-capability management method rather than editing database rows directly. Direct database changes can leave orphaned capabilities, make rollback difficult and bypass the testing and audit trail a store needs.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Registration settings and self-selected roles
WooCommerce registration settings can assign a default role, expose a restricted role selector and restrict selected pages by role. Keep self-selection limited to roles that are safe for an untrusted registrant. A public sign-up form should never let a visitor choose Administrator, Shop Manager or a vendor-management role simply by changing a form value.
For higher-risk workflows, require approval before assigning an elevated role. Test registration while logged out, test existing-user account linking and verify what happens when a user is assigned multiple roles. Also check whether an extension creates accounts through a separate form or API, because it may not follow the same registration setting.
Recommended Free Tools
REST API role filters: selection is not authorization
The WooCommerce REST customers endpoint supports role filters for administrator, editor, author, contributor, subscriber, customer and shop_manager. A role filter selects which records an authenticated request asks to receive; it does not grant permission to read or modify them.
Authentication and capability checks still decide whether the operation is authorized. Protect API credentials, use the narrowest integration account possible and test both read and write requests. A successful filter response should never be treated as proof that the account may perform every customer or user-management action.
WooCommerce.com collaborators are separate from site roles
Permissions granted to collaborators in a WooCommerce.com account are not WordPress roles on the store. An account owner can grant access to areas such as Downloads, Subscriptions, Connected Sites, Orders and Support. Collaborators cannot access stored payment details. These account-level permissions therefore need their own review; changing a WordPress role will not change a collaborator’s WooCommerce.com access, and vice versa.
Troubleshooting common role problems
“The Shop Manager cannot edit this customer.”
Check the WooCommerce version, the user’s complete set of roles and the woocommerce_shop_manager_editable_roles filter. A multi-role account is editable only when every assigned role is allowed. Also confirm that the account is not being restricted by another plugin or custom capability check.
Free tools Windows power users keep installed
One-click scans. No signup required.
“The role can see the menu but cannot save changes.”
Menu visibility and authorization are separate. Identify the capability checked on the save action, then compare it with the role’s capabilities. An extension may require a specific capability in addition to manage_woocommerce.
“A customer registered as the wrong role.”
Review WooCommerce’s default registration role, any role selector, approval workflow and extensions that create accounts. Test each registration path while logged out. Correct existing accounts manually only after confirming that the new role is safe for the user’s actual relationship to the store.
“A custom role stopped working after an update.”
Compare the role’s capability list before and after the update, read the extension’s release notes and repeat the staging tests. A renamed, newly required or newly removed capability can break one screen while leaving others functional.
Security checklist for WooCommerce roles
- Give each person the least privilege needed for their current duties.
- Reserve Administrator and Super Admin for trusted maintainers.
- Review customer-data, export, refund, payment and user-management capabilities separately.
- Do not rely on hidden menus as a security boundary; test authorization directly.
- Keep public registration restricted to low-risk roles and require approval for elevated access.
- Audit capabilities after every WooCommerce or extension update.
- Remove dormant accounts, rotate credentials and document exceptions.
- Use staging to test both allowed and blocked actions before production changes.
There is no qualifying official statistic establishing a universal rate of WooCommerce role errors or incidents, so role design should be based on the store’s actual workflows, data exposure and tested capability checks rather than a supposed industry average.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
