WordPress User Management — Adding, Editing and Managing Users

In this tutorial, you'll learn to manage WordPress users — adding users, editing profiles, resetting passwords, registration, and keeping your user base secure.

What You'll Learn

• How the Users screen works: list, columns, search, and filtering
• How to add new users and assign the correct role
• How to edit user profiles including contact info, bio, Gravatar, and toolbar settings
• Password management: reset, strong passwords, password managers
• User registration settings and new user notifications
• How to delete users and reassign their content
• User meta and the wp_usermeta database table
• Security best practices for managing users

Why It Matters

Your user base grows as your site grows. A personal blog might have one user (you). A business site might have five. A news site might have hundreds. Managing users properly ensures the right people have the right access, old accounts get cleaned up, and security risks from forgotten or compromised accounts are minimized. Every new user is a potential vulnerability — managing them carefully is essential site administration.

Real-World Use

A growing online magazine has 30 writers, 5 editors, 2 administrators, and a community of 2,000 registered subscribers who can comment. The site owner needs to add new writers weekly, remove writers who leave, reset forgotten passwords, and ensure that no one keeps access after they stop contributing. Without proper user management, old accounts accumulate, roles become incorrect, and security suffers.

Learning Path

flowchart LR
    A[User Roles] --> B[Managing Users]
    B --> C[Multisite Network]
    C --> D[Site Health & Debugging]
    B --> E[Security Hardening]

    style B fill:#38bdf8,color:#0f172a,stroke-width:2px

The Users Screen

Navigate to Users > All Users in the WordPress admin dashboard. This screen shows every user registered on your site.

Columns

The Users table displays these columns by default:

• Username — The user's login name (clickable to edit)
• Name — The display name (usually first and last name)
• Email — The user's email address
• Role — The user's role (Administrator, Editor, etc.)
• Posts — Number of posts authored by this user
• Registered — Date the user registered

You can show or hide columns using the Screen Options tab at the top of the screen.

Searching Users

Use the search box to find users by username, display name, or email address. This is useful when you have hundreds of users and need to find one quickly.

Filtering by Role

Use the role filter dropdown above the user list to show only users with a specific role. For example, to see only Editors, select "Editor" from the dropdown.

// Programmatically list all users with the Editor role
$editors = get_users(array('role' => 'editor'));
foreach ($editors as $editor) {
    echo '<p>' . esc_html($editor->display_name) . ' (' . esc_html($editor->user_email) . ')</p>';
}

Adding a New User

To add a user manually, go to Users > Add New and fill in the form.

Required Fields

• Username — Must be unique. Cannot be changed later. Choose carefully.
• Email — Must be unique. Used for password resets and notifications.
• Password — WordPress generates a strong password by default. You can override it.

Optional Fields

• First Name and Last Name — Used in display name settings.
• Website — The user's personal or business website.
• Send User Notification — If checked, WordPress sends the user an email with their username and password.

Setting the Role

Choose the appropriate role from the dropdown. Refer to the previous lesson on User Roles to choose the correct one.

// Programmatically create a new user
$user_id = wp_insert_user(array(
    'user_login' => 'jdoe',
    'user_email' => 'jdoe@example.com',
    'first_name' => 'Jane',
    'last_name'  => 'Doe',
    'role'       => 'author',
    'user_pass'  => wp_generate_password(), // Generate a strong password
));

if (is_wp_error($user_id)) {
    echo 'Error creating user: ' . $user_id->get_error_message();
} else {
    echo 'User created with ID: ' . $user_id;
    // Send the user their login details
    wp_new_user_notification($user_id, null, 'both');
}

The wp_insert_user() function creates or updates a user. If the user already exists (matched by user_login or user_email), it updates them instead. Always check for errors — the function returns a WP_Error object on failure.

Editing a User Profile

Click any username to open the profile editing screen. This screen has several sections.

Contact Info

• Email — Required. Used for password resets and Gravatar.
• Website — The user's website URL.
• Additional Contact Methods — By default, WordPress includes AIM, Yahoo IM, and Jabber / Google Talk. These are rarely used today. You can add custom contact fields using the user_contactmethods filter.

// Add custom contact methods
function mytheme_add_contact_methods($methods) {
    $methods['phone'] = 'Phone Number';
    $methods['linkedin'] = 'LinkedIn Profile';
    return $methods;
}
add_filter('user_contactmethods', 'mytheme_add_contact_methods');

About the User

• Biographical Info — A text area for the user's bio. This is commonly displayed on author archive pages.
• Profile Picture — WordPress uses Gravatar (Globally Recognized Avatar) by default. The user's email address determines their Gravatar image. To change it, the user must visit Gravatar.com and register their email.

Account Management

• Toolbar — Show or hide the admin toolbar when viewing the site. Most users keep this enabled.
• Language — Set a site language for this user, overriding the site default.
• Keyboard Shortcuts — Enable comment moderation keyboard shortcuts for power users.
• Application Passwords — Generate app-specific passwords for external tools (REST API, XML-RPC). This is useful for connecting external apps without using the main password.
• Sessions — Manage active sessions. You can log the user out everywhere except their current session.

Name Display

At the top of the profile, you can choose how the user's name appears publicly. Options include:

• Username
• First Name
• Last Name
• First + Last
• Last + First
• Nickname (a separate field you can set)

The selected option is used in bylines, author archives, and comment displays.

// Get the display name for a user
$user_info = get_userdata(42);
echo 'Display name: ' . $user_info->display_name;

// The display name is what WordPress shows publicly
// It is not the same as the username (used for login)

Your Profile

When you click Users > Your Profile (or Howdy, [name] > Edit My Profile), you see the same form but limited to your own user. This is what each user sees when editing their own information.

Admin Color Scheme

WordPress ships with several admin color schemes: Default, Light, Modern, Blue, Midnight, Sunrise, Eco, and others. Each user can choose their own. This is purely cosmetic but can help distinguish between users in a team.

Password Management

Resetting a User's Password

As an Administrator, you can change any user's password from their profile page. Scroll to the "Account Management" section, enter a new password, and click "Update Profile."

WordPress shows a password strength meter to encourage strong passwords. A weak password is marked in red, medium in yellow, and strong in green. Never set a weak password for any user.

User-Led Password Reset

If a user forgets their password, they can click "Lost your password?" on the login screen. WordPress sends a password reset link to their email address. The link expires after 24 hours by default.

// Customize the password reset expiration time
function mytheme_password_reset_expiration($expires) {
    return 3600; // 1 hour instead of 24 hours
}
add_filter('password_reset_expiration', 'mytheme_password_reset_expiration');

Enforcing Strong Passwords

WordPress encourages strong passwords with its built-in strength meter, but does not enforce them by default. You can enforce strong passwords with plugins like "Force Strong Passwords" or with custom code:

// Prevent weak password use during registration
function mytheme_validate_password_strength($errors, $user_data) {
    $password = $user_data['user_pass'];
    if (strlen($password) < 12) {
        $errors->add('weak_password', 'Password must be at least 12 characters.');
    }
    if (!preg_match('/[A-Z]/', $password)) {
        $errors->add('weak_password', 'Password must contain an uppercase letter.');
    }
    if (!preg_match('/[a-z]/', $password)) {
        $errors->add('weak_password', 'Password must contain a lowercase letter.');
    }
    if (!preg_match('/[0-9]/', $password)) {
        $errors->add('weak_password', 'Password must contain a digit.');
    }
    return $errors;
}
add_filter('registration_errors', 'mytheme_validate_password_strength', 10, 2);

Password Managers

Encourage all users to use a password manager like 1Password, Bitwarden, or LastPass. Password managers generate and store strong, unique passwords for every site. A password manager is the single best defense against account compromise.

User Registration Settings

To allow users to register themselves, go to Settings > General and check Membership: Anyone can register. Choose the default role for new users from the dropdown.

Choosing the Default Role

The default role for new registrations should almost always be Subscriber. Subscribers can only manage their own profile. Never set the default role to Administrator or Editor — that would give every person who registers full access to your site.

If your site needs users to contribute content, upgrade them manually after verifying their identity. Automated registration should always start with the most restricted role.

// Change the default registration role programmatically
update_option('default_role', 'subscriber');

New User Notification

When a new user registers, WordPress sends two emails by default:

1. To the admin — Notification that a new user registered.
2. To the user — Their username and a password reset link.

You can customize these emails using plugins or filters:

// Customize the admin notification email subject
function mytheme_new_user_notification_subject($subject, $user_id) {
    return 'New user registered: ' . get_userdata($user_id)->user_login;
}
add_filter('wp_new_user_notification_email_admin', 'mytheme_new_user_notification_subject', 10, 2);

Deleting Users

To delete a user, go to the All Users screen, hover over a username, and click Delete. Or select multiple users and choose "Delete" from the bulk actions dropdown.

Reassign Content

When you delete a user, WordPress asks what to do with their content:

• Delete all content — All posts and pages by this user are permanently deleted.
• Reassign content to another user — All content is attributed to the selected user. This is the safer option — you keep the content and just change the author.

// Programmatically delete a user and reassign their content
wp_delete_user($user_id, $reassign_to_user_id);

// If you pass null as the second parameter, content is deleted
wp_delete_user($user_id, null);

Always reassign content unless you are certain it can be deleted. Orphaned content deletion is irreversible.

User Meta and the wp_usermeta Table

WordPress stores additional user data in the wp_usermeta table. This is a key-value store where each row has a user_id, meta_key, and meta_value.

-- Sample data in wp_usermeta
SELECT user_id, meta_key, meta_value
FROM wp_usermeta
WHERE user_id = 1;

The wp_capabilities meta key stores the user's role as a serialized array. This is how WordPress knows which role a user has. You can read and write user meta using PHP functions:

// Get user meta
$bio = get_user_meta($user_id, 'description', true);

// Update user meta
update_user_meta($user_id, 'favorite_color', 'blue');

// Add user meta (creates a new row even if one exists)
add_user_meta($user_id, 'favorite_food', 'pizza');

// Delete user meta
delete_user_meta($user_id, 'favorite_food');

User meta is useful for storing custom profile fields. Plugins use it extensively — for example, WooCommerce stores billing and shipping addresses as user meta.

Bulk User Management

When you have many users to manage, doing them one at a time is slow. Here are strategies for bulk management.

Built-in Bulk Actions

On the All Users screen, select multiple users and choose from these bulk actions:

• Change role to... — Change all selected users to a single role.
• Remove role from... — Remove the selected role from users who have it.
• Delete — Delete all selected users (with content reassignment prompt).

Bulk Adding Users with Plugins

For adding many users at once, use plugins like "Import Users from CSV" or "WP Bulk User Manager." These let you upload a spreadsheet with user data and create accounts in bulk.

# If you have WP-CLI installed, you can add users from the command line
wp user create jdoe jdoe@example.com --role=author --display_name="Jane Doe"
wp user create bsmith bsmith@example.com --role=editor --display_name="Bob Smith"

WP-CLI is especially powerful for managing users at scale. You can list, create, update, delete, and modify users without the browser UI.

Security Best Practices

Limit Administrator Accounts

Keep Administrator accounts to an absolute minimum. Each Administrator account is a single compromised password away from total site takeover. A good rule: no more than two Administrators per site.

Regular User Audits

Review your user list monthly. Look for:

• Users who no longer need access (former employees, contractors)
• Users with incorrect roles (too permissive)
• Suspicious accounts (usernames that look like spam)
• Users who have never logged in

// Find users who have never logged in
$users = get_users(array(
    'meta_key' => 'last_login',
    'meta_compare' => 'NOT EXISTS',
));

foreach ($users as $user) {
    echo 'User ' . $user->user_login . ' has never logged in.' . "\n";
}

Note: WordPress does not track last login by default. You need a plugin or custom code to log login timestamps.

Monitor Failed Login Attempts

Failed login attempts can indicate a brute force attack. Use plugins like "Login LockDown" or "Limit Login Attempts Reloaded" to block IP addresses after too many failures.

Remove Unused Users

Delete or disable accounts for people who no longer need access. An old account with an unchanged password is a security hole waiting to be exploited.

Two-Factor Authentication

Enable two-factor authentication (2FA) for all Administrator accounts. Plugins like "Two Factor" (from the WordPress core team) or "Wordfence" add a second layer of security beyond the password.

Common Mistakes

1. Setting the default registration role to Administrator. This gives every person who signs up full control of your site. Always set the default role to Subscriber and upgrade users manually after verifying their identity.

2. Deleting users without reassigning content. When you delete a user with posts, WordPress asks about their content. If you choose "Delete all content," those posts are gone forever. Always reassign content to another user unless you are certain deletion is safe.

3. Creating users with weak passwords. Some administrators create users with passwords like "password123" because they plan to tell the user to change it later. Users often do not change it. Always set a strong password from the start.

4. Not cleaning up old user accounts. Former employees, contractors, or interns often retain access long after they stop working on the site. These orphan accounts are a security risk. Review and remove them regularly.

5. Giving users the wrong role. A common shortcut is making someone an Administrator "so they can do everything." This violates the principle of Least Privilege and multiplies security risk. Take the time to understand what the user needs and assign the correct role.

Practice Questions

1. You need to add 50 new subscribers to your membership site. What is the most efficient way? Answer: Use WP-CLI with a script (wp user create ...) or a CSV import plugin, rather than adding them one by one through the admin UI.

2. A user reports that their profile picture is not the image they want. Where should they change it? Answer: WordPress uses Gravatar. The user must visit Gravatar.com, register with their WordPress email address, and upload the desired image. The change reflects automatically on the WordPress site.

3. An editor is leaving the team. They have 120 published posts. What should you do when deleting their account? Answer: Reassign their content to another editor or administrator. Select the replacement user in the "Reassign content" dropdown when deleting. This keeps all 120 posts attributed to the correct author.

Challenge: Write a PHP function that runs on a cron schedule and emails the site admin a weekly report listing: new users registered that week, users who have not logged in for 90 days, and any Administrator accounts. Deploy it as a custom plugin.

FAQ

Mini Project

Build a complete user management workflow for a client site:

1. Configure user registration: enable registration in Settings > General, set default role to Subscriber.
2. Create three test user accounts: one Editor, one Author, one Subscriber.
3. Log in as each user and verify: the Subscriber can only see their profile; the Author can write and publish posts; the Editor can manage all content but cannot access plugins or settings.
4. Change the Author's password using the admin interface.
5. Delete the Subscriber account and reassign any content (create a dummy post first if needed).
6. Export the user list using a plugin or WP-CLI and review the data.
7. Write a brief security policy for the client: how often to review users, what to do when an employee leaves, and the minimum password requirements.

This exercise simulates the real-world task of onboarding and managing users for any WordPress site.

What's Next

Now that you can manage users, move on to Multisite Network to learn how users work across multiple sites in a network. Then explore Security Hardening to protect your user accounts from threats.

For more depth, see User Roles (understanding capabilities in detail) and PHP Database (advanced user queries with WP_User_Query).