Give one WordPress user more than one role, without replacing the primary one
Set up multi role assignment WordPress accounts can actually use: check a few extra roles on a user's profile, and their capabilities merge in immediately — no plugin conflicts, no core hacks, no losing the original role.
- Extra roles stack on top of the primary role, never replace it.
- Applied through a native user_has_cap filter, no core changes.
- Users list shows every role a person actually has.
- Feeds the same shared filter Two-Factor Auth and Telegram alerts use.
Multi role assignment WordPress: what does the module actually change?
This is what multi role assignment WordPress sites get with TheOneWP: TOWP_Multi_Role adds an "Additional Roles" section to every user's profile screen, where an administrator checks one or more extra roles beyond the primary one. The module stores the selection in a single towp_extra_roles user meta key, then merges each extra role's capabilities into the user through a user_has_cap filter — so the primary role stays exactly what it was, but the user can act on capabilities from every role checked. The Users list, the shared towp_user_roles filter, and every other TheOneWP module that checks roles all see the extra ones automatically.
WordPress only lets a user hold a single role
Core WordPress assigns exactly one role per user, so anyone whose job spans two roles — say, editing content and managing an online store — has to live with one role's limits or get capabilities patched in by hand.
Custom capability code is easy to lose track of
A one-off snippet that adds a capability to a specific user works, until nobody remembers it exists, or it silently breaks after a plugin or theme update.
Switching roles back and forth is not a real solution
Toggling a user's single role between two options depending on the task means the wrong permissions are active whenever someone forgets to switch back.
One primary role, any number of extra ones
The module adds a real, visible control on the profile screen and merges capabilities through the same filter WordPress core already checks on every permission test.
Stacks on the existing role
The primary role is never touched; extra roles only add capabilities on top of it.
Native capability filtering
Extra capabilities flow through user_has_cap, the same core WordPress permission check every plugin already respects.
Visible where roles already show up
The Users list Role column and every role-aware TheOneWP module reflect the extra roles without any extra setup.
The complete multi role assignment WordPress feature set
Every capability below is present in the class, its profile renderer, or the save and column-rendering methods.
Additional Roles chip picker
A row of selectable role chips on each user's profile screen, one per registered role except the primary — matches the site's Local Avatar card styling.
Capability merging, not role switching
Each extra role's granted capabilities get added to allcaps for that request; the user's roles array itself is never altered.
Enhanced Users list Role column
The built-in Role column gets replaced with one showing the primary role in bold and every extra role after it, comma-separated.
Shared towp_user_roles filter
Extra roles get exposed through a filter other TheOneWP modules already call, so role-based checks elsewhere pick them up with no configuration.
Gated by promote_users
Only users who can already promote other users can view or change anyone's extra roles — including their own.
Self-cleaning storage
Deselecting every extra role deletes the towp_extra_roles meta key outright instead of leaving an empty array in the database.
Assign multi role assignment WordPress-wide in four steps
Check the extra roles on a profile, then confirm the capability actually applies before rolling it out to more users.
Open the user's profile
Go to their profile.php (their own) or user-edit.php (as an admin) screen — the "Additional Roles" section appears automatically.
Check the extra roles needed
Select one or more roles beyond their primary one; the primary role itself is not offered again in the list.
Save the profile
Saving stores the selection in towp_extra_roles user meta, protected by a per-user nonce.
Confirm in the Users list
Check the Role column: the primary role appears in bold, with every extra role listed alongside it.
Where more than one role actually makes sense
The module fits accounts whose real responsibilities do not map to a single built-in WordPress role.
Editors who also manage the store
Give an Editor the Shop Manager role too, instead of choosing between content capabilities and order management.
Agencies with shared client accounts
Combine roles for a single agency contact who needs both content and limited administrative access on a client site.
Sites layering other TheOneWP modules
Any user with extra roles automatically gets matched correctly by Two-Factor Authentication and Telegram User Access Notification's own role filters.
Real roles, not a custom capability hack
Every design choice in the verified code favors WordPress's own permission system over a one-off workaround.
One small stylesheet, two admin screens
The verified implementation loads its one asset only where the feature is actually used.
One CSS file, two screens only
multi-role.css loads only on profile.php and user-edit.php, layered on the shared admin-page.css switch styles — nowhere else.
No JavaScript asset at all
The active-chip highlight is pure CSS, so there is no script file to enqueue or execute on the profile screen.
Capability check only when needed
The user_has_cap filter reads user meta only for users who actually have extra roles saved — an empty meta value short-circuits immediately.
Every submitted role gets checked twice
The save path treats every submitted role slug as untrusted until it proves otherwise.
Nonce-protected save
A per-user nonce, towp_multi_role_{user_id}, must verify before save_extra_roles() touches anything.
Capability-gated on both ends
Rendering the section and saving it both require promote_users — nobody without it can see or change extra roles for any account.
Role slugs validated against real roles
Submitted values get sanitized with sanitize_key(), then intersected against the actual list of registered role slugs — an invented or renamed role slug never makes it into storage.
Primary role explicitly excluded
Even if the primary role somehow appears in the submitted list, the save handler removes it from the extra-roles array before storing anything.
Built on the same filter other modules already call
The supplied code integrates through native WordPress hooks and a shared internal filter used across the plugin. No compatibility claim beyond the verified implementation is assumed.
user_has_cap
The core filter WordPress uses for every permission check — extra-role capabilities merge in here, alongside whatever the primary role already grants.
Two-Factor Auth & Telegram Notify
Both modules call the shared towp_user_roles filter for their own role-matching, so extra roles from this module apply automatically.
Users list & profile screens
Hooks manage_users_columns, manage_users_custom_column, show_user_profile and edit_user_profile — all native WordPress admin hooks.
TheOneWP versus common alternatives
Compare a real multi role assignment WordPress implementation with typical dedicated role plugins or a custom capability snippet.
| Capability | TheOneWP Multi Role Assignment | Other common solutions |
|---|---|---|
| Primary role | Always preserved; extra roles only add on top | Some plugins replace the primary role entirely |
| Where it shows up | Profile screen chip picker plus an updated Users list column | Often settings-screen only, invisible in the Users list |
| Validation | Submitted slugs checked against real registered roles | Varies; a custom snippet may trust input directly |
| Cross-module awareness | Shared filter used by other TheOneWP role-based modules | A standalone plugin has no such integration |
| Extra assets | One small CSS file, two admin screens, zero JavaScript | May load a full framework or JS-driven UI |
| Administration | A single toggle in the TheOneWP settings panel | May require a separate plugin and its own settings screen |
Keep extra roles deliberate and visible
A little discipline keeps multi-role accounts easy to audit later.
Add only the roles a task actually needs
Checking every available role "just in case" defeats the purpose of role-based permissions in the first place.
Check the Users list after assigning
Confirm the Role column shows exactly the combination you expect before considering the change done.
Review multi-role accounts periodically
A role added for a temporary project is easy to forget — revisit accounts with extra roles now and then.
Remember it changes capabilities, not identity
The user's primary role — and anything keyed off it directly, rather than through capability checks — stays the same.
Avoid assumptions the code does not support
The module has a defined, verified scope — a few assumptions outside it cause confusion.
Expecting a non-admin to self-serve extra roles
Editing extra roles requires promote_users; a user without it cannot grant themselves or anyone else additional roles.
Assuming the primary role changes too
The primary role stays exactly as it was. Code or plugins that check $user->roles[0] directly still see only the original role.
Overloading one account with every role
Stacking roles that were never meant to coexist can grant unexpected capability combinations — check what each role actually includes first.
Multi Role Assignment FAQ
These answers come directly from the verified class, settings renderer and profile-save logic.
Does Multi Role Assignment replace a user's primary WordPress role?
No. Extra roles sit on top of the primary role; the primary role never changes. The "Additional Roles" list on the profile screen even leaves the primary role out, since it is already assigned.
Where do extra roles get stored?
In a single user meta key, towp_extra_roles, as an array of role slugs. If an admin unchecks every extra role, the module deletes the meta key entirely rather than leaving an empty array behind.
How does a user actually gain the extra capabilities?
Through a user_has_cap filter. For each extra role a user has, the module reads that role's capabilities and adds any granted ones to the user's allcaps for the current check — WordPress core's own role system is never modified.
Can someone grant themselves a role they should not have?
The save handler sanitizes every submitted slug, keeps only ones that match a real registered WordPress role, and explicitly removes the primary role from the submitted list even if it was somehow included. Only users with the promote_users capability can save changes at all.
Does the Users list show the extra roles?
Yes. The module renames the built-in Role column and re-renders it itself: the primary role appears in bold, followed by any extra roles in normal weight, comma-separated.
Do other TheOneWP modules see the extra roles too?
Yes, automatically. The module adds extra roles to the shared towp_user_roles filter, which Two-Factor Authentication and Telegram User Access Notification both already use for their own role-matching checks.
Does this module load its own JavaScript?
No. The active-chip highlight on the profile screen uses a CSS :has() selector to style a chip when its checkbox is checked — there is no JavaScript file for this module at all.
Can a user manage their own extra roles?
No. Editing extra roles requires the promote_users capability, the same one WordPress uses to gate role changes anywhere else — a user without it never sees a way to change their own roles.
Stop choosing one role per person.Assign exactly the capabilities each account needs.
Use multi role assignment WordPress admins can trust: primary roles preserved, capabilities merged natively, visible everywhere roles already show up.