Build the exact roles your team actually needs
Role Manager creates, edits, duplicates and deletes WordPress roles with a full capability matrix, plus per-role login redirects and URL access rules — all from a dedicated admin page, with Administrator always protected from lockout.
- Create, duplicate and delete roles beyond WordPress's stock five.
- A full capability matrix, grouped by area, with Enable all / Disable all.
- Per-role login/logout redirects and URL blocking rules.
- The Administrator role can never be deleted or stripped of its capabilities.
Posts
What does Role Manager do?
When the role_manager module is active, TOWP_Role_Manager adds a dedicated admin page for creating, editing, duplicating and deleting WordPress roles, with every capability grouped by area (Posts, Pages, Media, Comments, Themes, Plugins, Users, Settings, and any custom capability another plugin has registered) switchable individually. A second Rules tab sets a login redirect, a logout redirect, and blocked or redirected URLs per role, including for logged-out visitors through a virtual "Guest" entry. Since the Administrator role stays protected throughout, with its capabilities and slug permanently fixed and only its display name changeable, the account managing roles can never accidentally lock itself out.
WordPress ships five roles that rarely fit
Because every organization looks different, one fixed set of five roles rarely maps cleanly onto how a real team actually works.
Five roles, one shape, for every kind of team
WordPress arrives with the same five roles regardless of what an organization actually looks like, leaving most sites either stretching a role to cover more than it should or granting more access than a job actually needs.
The safe way to add a role usually means code
Without a dedicated interface, creating a genuinely new role means writing PHP, and getting a capability wrong can be difficult to notice until someone can't do their job, or can do more than they should.
Any role, any capability, changed safely
The module gives every capability its own switch, and every role its own page, without ever risking the one role a site can't afford to lose.
A full capability matrix, grouped by area
Every WordPress capability, organized into clear groups, switchable individually or all at once for a whole group.
Duplicate a role instead of starting from scratch
Clone an existing role and adjust a few capabilities, rather than building a new one from an empty slate.
Administrator can never be locked out
The Administrator role's capabilities and slug stay fixed permanently, so the account managing roles is always safe.
Roles, capabilities and rules, all in one page
Every capability below is present in the supplied PHP class, its view template and the settings registration.
Every capability, grouped and switchable
Posts, Pages, Media, Comments, Themes, Plugins, Users, Settings & Options and Dashboard & Admin, each with Enable all and Disable all for the whole group.
Anything another plugin registers, found automatically
Capabilities that don't match the standard WordPress set get grouped separately, so a role covers whatever another plugin actually checks for.
Every affected user reassigned automatically
Changing a role's slug creates the new role, moves every user who had the old one, and removes the old role, all in a single save.
Users never left without a role
Deleting a role reassigns anyone who only had that role to a fallback, and cleans up any reference to it left by the Multi Role module.
Login redirects, logout redirects, blocked paths
A separate Rules tab sets a login redirect, a logout redirect, and wildcard-pattern URL rules, with a choice of 404 or redirect for anything blocked.
A virtual Guest role for anyone not logged in
The same URL rules apply to a virtual "Guest" entry, letting the same blocking and redirect logic cover visitors who aren't logged in at all.
Where custom roles help most
The module supports any site whose team structure doesn't map cleanly onto WordPress's default five roles.
Organizations that don't map to WordPress's five roles
Create a role for a specific department or job function, with exactly the capabilities that function actually needs.
Restricting specific roles from specific pages
Block a role from reaching certain URLs entirely, whether that's an internal page or a section of the site meant for another team.
A tailored landing page after login
Send each role somewhere specific after logging in, instead of everyone landing on the same default dashboard.
Roles that fit, a system that can't break itself
The module combines genuine flexibility with a design that protects the one role every site depends on.
Rules checked only when rules exist
The verified implementation adds no overhead to a site that isn't using the URL rules feature.
URL rules check only when rules exist
The blocked-URL and redirect logic exits immediately if no rules have been configured at all, adding no overhead to a site that isn't using that feature.
Assets load only on the Role Manager page
The module's script and styles only enqueue on its own dedicated admin screen, not across the rest of wp-admin.
A simple pattern match per rule
Checking a URL against a blocked pattern is a straightforward string or regex comparison, not a database query.
Administrator, permanently out of reach of a mistake
The code goes out of its way to make the one role every site depends on impossible to break.
Administrator's capabilities and slug are permanently fixed
Even an administrator using the tool can only ever change that role's display name, never its access or its identifier.
Every action requires manage_options
Creating, editing, duplicating, deleting a role, and saving URL rules, all require the same capability needed for any other site-wide setting.
Nonce-verified on every request
Each AJAX action checks a nonce before making any change, the same protection WordPress uses throughout its own admin.
No user left without a role
Deleting a role always reassigns affected users to a working fallback role, rather than leaving anyone without one.
Built directly around WordPress's own role functions
The supplied code integrates through APIs present in WordPress core and TheOneWP's own modules; this page makes no compatibility claim beyond the verified implementation.
add_role(), remove_role(), get_role()
The standard WordPress functions for creating, deleting and reading roles, used throughout rather than manipulating role data directly.
login_redirect, clear_auth_cookie, wp_logout
The native WordPress hooks used to redirect a user based on their role immediately after logging in or out.
towp_user_roles filter respected
Role checks run through the same filter a Multi Role module can extend, and role deletion cleans up any extra-role reference that module may have stored.
TheOneWP versus common alternatives
Compare the verified Role Manager implementation with editing roles through code or a scattered set of plugins.
| Capability | TheOneWP Role Manager | Other common solutions |
|---|---|---|
| Creating and editing roles | A full capability matrix, grouped and searchable | Often requires a code snippet or a separate plugin |
| Protecting Administrator | Capabilities and slug permanently fixed | A misconfigured plugin can strip admin access entirely |
| Changing a role's slug | Every affected user reassigned automatically | Can silently orphan users tied to the old slug |
| Role-based URL rules | Login/logout redirects and blocked URLs, including guests | Rarely available without a separate access-control plugin |
| Administration | One dedicated page for roles, capabilities and URL rules | Usually split across multiple plugins |
Build a new role in four steps
Start from a close-enough role whenever one already exists.
Enable Role Manager
Activate the module from the TheOneWP Utility settings tab.
Create or duplicate a role
Start from a new role, or duplicate an existing one that's close to what's needed.
Set the capability matrix
Switch on exactly the capabilities the role needs, using Enable all or Disable all per group as a starting point.
Configure URL rules if needed
Use the Rules tab to set a login redirect, a logout redirect, or blocked URLs for that role.
Start narrow, widen only when needed
A cautious starting point makes every later adjustment easier to reason about.
Duplicate before editing an existing role
Cloning a role first means the original stays available as a reference, or a fallback if the new one needs adjusting.
Grant capabilities narrowly, then widen if needed
Starting with fewer capabilities and adding more as a real need appears is safer than starting broad and trying to narrow later.
Test URL rules from a real account with that role
Confirm blocked URLs and redirects behave as expected by checking them from an account actually assigned to that role.
Use Reset to Defaults only when truly starting over
Resetting removes every custom role entirely and rebuilds WordPress's original five, so use it deliberately, not as a quick fix.
Avoid assumptions that catch teams off guard
A few details are easy to misjudge the first time through the interface.
Expecting to edit Administrator's capabilities
Administrator's capabilities and slug stay fixed permanently; only its display name can change, by design.
Forgetting the Guest role covers logged-out visitors
URL rules set for "Guest (not logged in)" apply to anyone who isn't logged in at all, not to a specific role.
Using Reset to Defaults without meaning to remove every custom role
Since the reset option deletes every role outside WordPress's original five, along with all saved URL rules, it isn't a per-role undo.
Role Manager FAQ
These answers come directly from the verified class, its view template and the settings registration.
What does Role Manager do?
It creates, edits, duplicates and deletes WordPress roles with a full capability matrix, and sets per-role login redirects, logout redirects and URL blocking rules.
Can I delete the Administrator role?
No. Administrator stays permanently protected; only its display name can change, never its capabilities or its slug.
What happens to users if I change a role's slug?
Every user with that role gets automatically reassigned to the new slug as part of the same save, so nobody ends up without a role.
What happens to users if I delete a role?
Anyone who only had that role gets reassigned to a fallback role, so no user is left without one.
Can I block a specific role from certain pages?
Yes. The Rules tab lets you block URLs, with wildcard support, per role, choosing whether a blocked visit gets a 404 or a redirect.
Does this work for visitors who aren't logged in?
Yes, through a virtual "Guest (not logged in)" entry that gets the same URL rules as any real role.
Can I set where a role lands after logging in?
Yes. Each role can have its own login redirect, applied instead of WordPress's default destination.
What does Reset to Defaults actually do?
It deletes every role outside WordPress's original five and rebuilds those five with their standard capabilities, also clearing all saved URL rules.
Does this detect capabilities added by other plugins?
Yes. Any capability that doesn't match the standard WordPress set gets grouped separately, so it can still get assigned to a role.
Who can create, edit or delete roles?
Only an administrator with the manage_options capability.
Stop stretching five roles to fit your whole team.Build the exact roles your site actually needs.
Use Role Manager to create, edit and duplicate roles with a full capability matrix, plus per-role login redirects and URL rules, with Administrator always protected.