Users and Security

Users and Security

Roles

Role	Can
Admin	Everything, including users, plugins and settings.
Editor	Create, edit and publish all content.
Author	Write and edit their own content.
Viewer	Sign in and look; the role people get when they register themselves.

Manage people under Users; Roles & permissions shows exactly what each role may do.

Invite someone

Under Users, invite by e-mail and choose a role. They get a link to set their own password.

Two-step login

Turn on two-step login for every administrator: after the password, a code from an authenticator app is needed. Keep the backup codes somewhere safe.

Built-in protection

• Sign-up asks for the password twice.
• Known risky default routes are blocked.
• The REST API is closed by default (API and AI Assistants).
• Text boxes cannot be blanked by accident on save (Writing and Editing).
• Google Analytics only loads after a visitor accepts cookies (Plugins).

Errors

If something goes wrong, visitors and editors never see technical details: they get a friendly page with a short reference code. The details are kept for you under Settings › Error log (30 days, administrators only). Search for the reference code someone gives you to see exactly what happened.