WooCommerce user roles determine which parts of a store a person can see and change. Customer is for shoppers, Shop Manager is for day-to-day catalog, order, customer, and report work, and Administrator controls the entire WordPress site. WordPress roles are only containers; the individual capabilities inside them decide what a user can actually do.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The safest setup is to assign the least powerful role that supports the job, audit its capabilities (including those added by extensions), test both permitted and blocked actions on staging, and review the result after WooCommerce or extension updates.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →How WooCommerce roles work
WooCommerce uses WordPress’s role-and-capability system. A role is a named bundle of permissions, while a capability is one permission checked by WordPress or a plugin. For example, manage_woocommerce, create_customers, and list_users are separate capabilities associated with Shop Manager workflows. Possessing one does not automatically grant the others.
This distinction matters when you create a custom role or investigate an access problem. A role name can look harmless while an extension has added powerful capabilities to it, and two roles with similar names can behave differently. WordPress’s Developer Handbook describes roles and capabilities as the mechanisms used to control user privileges; in practice, capability audits are more reliable than trusting a label.
#1 Best Overall
WordPress core supplies Super Admin, Administrator, Editor, Author, Contributor, and Subscriber. WooCommerce adds Customer and Shop Manager. Marketplace or vendor extensions can add roles such as Vendor Admin and Vendor Manager, with permissions defined by that extension’s configuration.
WooCommerce and WordPress roles compared
| Role | Primary purpose | Store operations | WordPress-wide access | User-management exposure | Origin |
|---|---|---|---|---|---|
| Administrator | Trusted site owner or maintainer | All WooCommerce functions available to the site | Broad control of configuration, plugins, themes, and content on one site | Can administer users and roles | WordPress core |
| Shop Manager | Operational store staff | Catalog, orders, customers, and reports, subject to capabilities and extensions | Less WordPress-wide control than Administrator | Has specific capabilities such as list_users and, in current WooCommerce behavior, may edit certain customer accounts |
WooCommerce core |
| Customer | Ordinary shopper account | Usually limited to the customer’s own account, orders, and checkout-related pages | No general site administration | No staff user administration | WooCommerce core |
| Subscriber | Minimal WordPress account | No built-in store-management role | Profile and basic read access | No staff user administration | WordPress core |
| Editor | Content manager | Not a substitute for Shop Manager | Manages posts and other editorial content according to its capabilities | Not intended for WooCommerce staff administration | WordPress core |
| Author or Contributor | Content creation workflows | No inherent WooCommerce operations | Creates or edits content within its editorial limits | No general staff administration | WordPress core |
| Vendor Admin or Vendor Manager | Multi-vendor marketplace work | Vendor-specific products, orders, or settings defined by the vendor extension | Depends on the extension | Depends on the extension’s capabilities | Extension-provided |
The table describes the intended scope, not a security guarantee. Plugins can add capabilities, remove them, or check them in unexpected places. Always inspect the effective capability set on the actual site.
Free tools Windows power users keep installed
One-click scans. No signup required.
What each common role should be used for
Administrator
Administrator is the broadest normal role on a single WordPress site. It can change site settings, install or configure plugins and themes, manage users, and perform WooCommerce administration. Give it only to a trusted owner or maintainer who genuinely needs site-wide control. An employee who only processes orders does not need Administrator, and an account with this role can change the controls that protect every other user.
Shop Manager
Shop Manager is WooCommerce’s operational role. It is intended for staff who maintain products, process orders, manage customer records, and read store reports without receiving full WordPress configuration access. WooCommerce documents capabilities including manage_woocommerce, create_customers, and list_users; each is an independent permission check.
Shop Manager is not a “safe Administrator.” Depending on installed extensions, it may still expose sensitive order or customer data, and a plugin can add additional management capabilities. Remove capabilities that are not required for a particular staff member rather than assuming the role is automatically narrow.
Rank #2
Customer
Customer is the usual account role for shoppers. It supports customer-facing activities such as maintaining a profile, placing orders, and viewing that customer’s own order history. Registration behavior is configurable, so a store can assign a different default role or use an extension that changes account creation. Customers should never be allowed to self-select an operational role.
Subscriber
Subscriber is a WordPress role with minimal profile and reading access. It is distinct from Customer even though both are low-privilege roles. Use Subscriber when the account is primarily for WordPress content or membership access and does not need WooCommerce’s customer behavior.
Editor, Author, and Contributor
These are content roles. They govern publishing and editing posts or other editorial content, not product catalogs, orders, refunds, or reports. Giving an editor access to a store task because the title sounds senior can produce either missing permissions or excessive access; assign a WooCommerce-focused role or a custom capability set instead.
Vendor roles
Multi-vendor extensions may register Vendor Admin, Vendor Manager, or similar roles. Their capabilities vary by extension and configuration, so there is no universal definition. Check which products, orders, commissions, customer details, and settings the extension exposes before assigning one.
Roles versus capabilities: what to audit
When evaluating access, make a list of the person’s tasks first: edit products, fulfill orders, issue refunds, view reports, create customer accounts, or manage users. Then map each task to the capability the relevant plugin checks. Review capabilities inherited from every role assigned to the account, not just the first role shown in the profile.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →- Inspect the role’s effective capabilities, including those added by payment, fulfillment, membership, subscription, or marketplace extensions.
- Separate read access from write, delete, export, and configuration access.
- Treat customer and order data as sensitive even when the role cannot change site settings.
- Record the reason for each elevated capability so it can be removed when the job changes.
A role editor can display and change capabilities, but changing a checkbox without understanding which code checks it can break workflows. Make changes on staging, document the before-and-after capability list, and test the exact screens and actions the user needs.
A safe role-assignment workflow
- Define the job. Write down the person’s required actions and the data they must see. “Help with the store” is not specific enough; “update stock quantities and view fulfillment orders” is.
- Start with the least powerful role. Test Customer, an existing content role, Shop Manager, or a narrowly designed custom role before considering Administrator.
- Inspect capabilities. Include capabilities supplied by WooCommerce and every extension that handles products, orders, payments, subscriptions, vendors, or customer data.
- Assign the role on staging. Use a test account that has the same combination of roles as the real user. Multiple roles combine their capabilities.
- Test allowed actions. Log in as the test account and perform each required task: opening the relevant screen, saving a change, completing an order action, and viewing any report or customer record.
- Test blocked actions. Attempt to open user administration, plugin and theme settings, payment configuration, exports, and other sensitive screens. A successful block is as important as a successful task.
- Repeat after updates. WooCommerce and extensions can add or change capabilities and permission checks. Re-run the access test after updates, especially when a new staff workflow or integration is introduced.
Shop Manager and customer-account editing in WooCommerce 11.2.0
WooCommerce 11.2.0 allows a Shop Manager to edit a user whose only assigned role is Customer by default. The woocommerce_shop_manager_editable_roles filter changes that allowlist. If a user has multiple roles, every assigned role must be allowed for the Shop Manager edit operation to proceed.
This filter controls which roles are editable; it does not grant general WordPress user-management capabilities. Likewise, having manage_woocommerce does not automatically make a role editable. Keep those checks separate when troubleshooting why a Shop Manager can see a screen but cannot save a user.
Registration settings and self-selected roles
WooCommerce registration settings can assign a default role, expose a restricted role selector, and restrict selected pages by role. Configure self-selection only for roles safe for an untrusted registrant—normally a shopper role. Never expose Shop Manager, Administrator, vendor-management, or other staff roles in a public registration form.
For higher-risk workflows, use an approval process. A pending application can be reviewed and assigned an appropriate role manually, while the public form creates only a low-privilege account. Recheck settings after installing an extension that adds registration fields or role choices, because it may introduce a second path to account creation.
Rank #4
REST API role filters are not authorization
The WooCommerce REST customers endpoint accepts role filters for administrator, editor, author, contributor, subscriber, customer, and shop_manager. A filter selects which records are returned; it does not grant permission to read, create, edit, or delete them.
Authentication and capability checks still decide whether an API request is authorized. Protect API credentials, use the narrowest account capable of the integration’s job, and verify that the integration cannot access unrelated users or orders.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.WooCommerce.com collaborators are a separate system
Permissions granted to collaborators in a WooCommerce.com account are not WordPress roles on the store. An account owner can grant access to areas such as Downloads, Subscriptions, Connected Sites, Orders, and Support. Collaborators cannot access stored payment details through that arrangement.
Manage the two systems independently: a person may need a WordPress Shop Manager role for store operations but only Support access in the WooCommerce.com account, or the reverse. Removing one type of access does not remove the other.
How to create a custom WooCommerce role safely
A custom role is appropriate when Shop Manager is too broad and a WordPress content role is irrelevant. The safe pattern is to begin with the smallest existing role that resembles the job, add only capabilities confirmed as necessary, and remove anything that grants unrelated configuration or data access.
Best Value
- Keep track of everything from attendance to test scores
- Spiral bound
- Measures 8-1/2" x 11"
Design the capability set
- List every required task and the screen or endpoint used to complete it.
- Identify the exact capabilities checked for those tasks by WooCommerce and installed extensions.
- Separate product, order, customer, report, export, and configuration permissions instead of treating them as one “store” permission.
- Document capabilities that must remain absent, such as plugin installation or unrestricted user administration.
Implement and test
Use a maintained role-and-capability management tool or a small, version-controlled WordPress code change. Do not edit the database directly. Give the role a distinct slug and display name, assign only the audited capabilities, and create a test user with no other roles.
Test the complete workflow on staging, including direct URL access and REST requests where applicable. Verify that denied actions fail cleanly and that an extension does not silently require an additional capability. Promote the change only after recording the final capability list and a rollback plan.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsMaintain the role
Review custom roles after WooCommerce and extension updates. A new feature may require a new capability, while a changed permission check can make an old capability more powerful than intended. Remove the role from departing staff immediately and delete unused custom roles only after moving their users to an approved replacement.
Troubleshooting common permission problems
The staff member cannot see a WooCommerce screen
Check whether the account has the capability required by that screen, whether another extension has replaced the menu, and whether the user’s roles were changed by an update. Compare the effective capabilities with a known-working test account rather than adding Administrator as a shortcut.
The user can see a screen but cannot save
Viewing and modifying are often separate checks. Confirm the write capability for the specific object—product, order, customer, report, or setting—and inspect whether the object belongs to a vendor or another restricted scope.
A Shop Manager cannot edit a customer
On WooCommerce 11.2.0, confirm that the customer’s complete set of assigned roles is included in the woocommerce_shop_manager_editable_roles allowlist. Remember that the filter does not itself grant user-management capabilities.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
A customer received staff access during registration
Review the default role and any public role selector in WooCommerce registration settings, then inspect extension-created registration forms. Remove unsafe choices, reset affected accounts, and require approval for elevated roles.
Quick Recap
Operational checklist
- Use Administrator only for trusted site-wide maintainers.
- Use Shop Manager for operational staff, then narrow capabilities when the job does not require the full role.
- Keep Customer and Subscriber distinct according to whether the account needs WooCommerce shopper behavior.
- Audit extension-added capabilities and vendor roles individually.
- Test both successful and blocked actions on staging.
- Review roles after WooCommerce 11.2.0-era changes and future extension updates.
- Remove staff access promptly when responsibilities end.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
