Securing WordPress: Roles, Passwords, and 2FA

User access management is the foundation of WordPress security. Most successful attacks exploit weak passwords, excessive permissions, or compromised user accounts. This guide covers essential practices for managing user roles, enforcing strong passwords, and implementing two-factor authentication—forming a robust defense against unauthorized access.

I. Understanding WordPress User Roles

WordPress includes six default roles with different permission levels.

A. Default Role Hierarchy

• Super Admin: (Multisite only) Full control over the entire network.
• Administrator: Complete site control—themes, plugins, users, settings.
• Editor: Manage and publish all posts, including others' content.
• Author: Publish and manage own posts only.
• Contributor: Write and edit own posts, but cannot publish.
• Subscriber: Read content and manage own profile only.

B. Assigning Appropriate Roles

• Content writers: Author role (can publish) or Contributor (needs approval).
• Content managers: Editor role for managing content workflow.
• Site maintenance: Administrator only for trusted technical staff.
• Newsletter subscribers: Subscriber role—never higher.

II. The Principle of Least Privilege

Users should have only the minimum permissions required for their tasks.

A. Why It Matters

• Limits damage: If an account is compromised, attackers gain only that role's permissions.
• Reduces errors: Users can't accidentally break things they can't access.
• Simplifies auditing: Clear role boundaries make permission reviews easier.

B. Common Mistakes

• Everyone is admin: Content writers don't need plugin access.
• Shared accounts: Each person should have their own account for accountability.
• Permanent permissions: Revoke access when project work ends.

III. Custom User Roles

Create roles tailored to your specific workflow needs.

A. When to Create Custom Roles

• SEO managers: Edit posts and manage SEO plugins, but not users or settings.
• Ad managers: Access ad placement settings without full admin access.
• Shop managers: WooCommerce order management without core WordPress access.

B. Creating Custom Roles with Code

// Add to functions.php or a site-specific plugin
add_action('init', 'create_seo_manager_role');

function create_seo_manager_role() {
    add_role('seo_manager', 'SEO Manager', array(
        'read' => true,
        'edit_posts' => true,
        'edit_others_posts' => true,
        'edit_published_posts' => true,
        // Add SEO plugin capabilities as needed
    ));
}

IV. Password Security Best Practices

Passwords remain the most common attack vector for WordPress sites.

A. Strong Password Requirements

• Minimum 16 characters: Longer passwords resist brute force attacks.
• Mix of types: Uppercase, lowercase, numbers, and symbols.
• Unique per site: Never reuse passwords across different accounts.
• Avoid patterns: No keyboard walks (qwerty), no personal info (birthdays).

B. Enforcing Password Policies

// Force strong passwords for specified roles
add_action('user_profile_update_errors', 'enforce_strong_password', 10, 3);

function enforce_strong_password($errors, $update, $user) {
    if (!$update) return; // Only on updates
    
    $password = isset($_POST['pass1']) ? $_POST['pass1'] : '';
    if (empty($password)) return;
    
    // Check minimum length
    if (strlen($password) < 16) {
        $errors->add('weak_password', 
            'Password must be at least 16 characters.');
    }
    
    // Check complexity
    if (!preg_match('/[A-Z]/', $password) ||
        !preg_match('/[a-z]/', $password) ||
        !preg_match('/[0-9]/', $password) ||
        !preg_match('/[^A-Za-z0-9]/', $password)) {
        $errors->add('weak_password', 
            'Password must include uppercase, lowercase, numbers, and symbols.');
    }
}

C. Password Managers

• 1Password/Bitwarden: Generate and store unique passwords.
• Team sharing: Secure credential sharing for teams.
• Breach monitoring: Alerts if passwords appear in data breaches.

V. Implementing Two-Factor Authentication

2FA is the single most effective protection against account compromise.

A. 2FA Methods Ranked by Security

• Hardware keys (best): YubiKey, Google Titan—phishing resistant.
• Authenticator apps (good): Google Authenticator, Authy—time-based codes.
• SMS codes (acceptable): Better than nothing, but vulnerable to SIM swapping.
• Email codes (minimal): Only if email itself has strong 2FA.

B. Recommended 2FA Plugins

• Two-Factor: Official WordPress plugin, supports multiple methods.
• Wordfence: 2FA included with security suite.
• WP 2FA: Focused 2FA plugin with user-friendly setup.
• Google Authenticator: Simple TOTP implementation.

C. Enforcing 2FA for Administrators

// Require 2FA for admin login (after 2FA plugin is active)
add_action('wp_login', 'check_admin_2fa_required', 10, 2);

function check_admin_2fa_required($user_login, $user) {
    if (!user_can($user, 'manage_options')) return;
    
    // Check if 2FA is configured (plugin-specific check)
    $two_factor_enabled = get_user_meta($user->ID, 
        '_two_factor_enabled', true);
    
    if (!$two_factor_enabled) {
        // Redirect to 2FA setup page
        wp_redirect(admin_url('profile.php?setup_2fa=required'));
        exit;
    }
}

VI. Login Security Hardening

Additional measures to protect the login process.

A. Limit Login Attempts

• Block after failures: 5 failed attempts triggers temporary block.
• Progressive delays: Increasing lockout duration for repeat offenders.
• IP tracking: Monitor and block suspicious IP ranges.

B. Change Login URL

• Security through obscurity: Moves target from /wp-admin/ and /wp-login.php.
• Reduces bot traffic: Automated attacks target default URLs.
• Plugins: WPS Hide Login, Rename wp-login.php.

C. Disable XML-RPC

// Disable XML-RPC to prevent brute force through this interface
add_filter('xmlrpc_enabled', '__return_false');

// Also block it at .htaccess level
// <Files xmlrpc.php>
// order deny,allow
// deny from all
// </Files>

VII. User Audit Practices

Regular reviews prevent security drift.

A. Monthly Audit Checklist

• Count admin users: Should be minimal—typically 1-2.
• Review all accounts: Remove any you don't recognize.
• Check last login: Inactive accounts should be disabled.
• Verify 2FA status: All admins should have 2FA enabled.

B. Removing Unused Accounts

• Delete or demote: Former team members should have access removed immediately.
• Content attribution: Reassign posts before deleting author accounts.
• Documentation: Keep records of who has/had access.

VIII. Recovering from Compromise

Steps if you suspect an account has been compromised.

A. Immediate Actions

• Reset all passwords: Change every admin password immediately.
• Review user list: Look for unauthorized new accounts.
• Check for backdoors: Scan files for suspicious code additions.
• Review recent changes: Check plugin/theme modifications.

B. Force All Users to Reset

// Force all users to reset password on next login
global $wpdb;
$wpdb->query("UPDATE {$wpdb->users} SET user_pass = ''");

// Users will need to use "Lost your password?" to reset

IX. Conclusion

Proper user management is fundamental WordPress security. Apply the principle of least privilege when assigning roles, enforce strong unique passwords, and require two-factor authentication for all accounts with elevated privileges. Conduct regular audits to remove stale accounts and verify permissions remain appropriate. These practices prevent the majority of WordPress compromises while maintaining a productive environment for legitimate users.

What security practices have you implemented for user management? Share your experience in the comments!