Give each person only the access their work needs

1. Plan the work and recovery ownership

Open the role-plan worksheet below. Match each task to the minimum role: Administrator for site administration, Editor for review and publishing across authors, Author for their own posts, and Contributor for drafts that need review. A plugin can change capabilities, so compare this plan with the actual installed site. Complete the privileged-access register on the same full worksheet. Name the owner and recovery owner, keep unique credentials in a password manager, prepare a later two-factor exercise without changing real accounts here, and set a review/removal date. Use an Editor account for normal editorial work. Keep the only verified recovery Administrator during the exercise. The worksheet contains no credentials and grants no real access.

2. Review the current owner account

Sign in to the disposable site as its Administrator. Open Users → All Users. Read the role count and identify the account that owns this practice installation. Our screenshot has one synthetic Course owner and an example.test address. On a real site, reconcile each account with its owner before changing access. Keep the private access register separate from public screenshots.

3. Create the three synthetic accounts

Choose Add User. Enter cedar-editor and cedar-editor@example.test, set Role to Editor, and use a unique generated password. Use Hide so the password is masked before taking any screenshot. For this local exercise, clear Send the new user an email about their account. Click Add User. Repeat the same form for cedar-author / cedar-author@example.test / Author and cedar-contributor / cedar-contributor@example.test / Contributor, using different passwords. Keep them privately. Return to Users and read back all three usernames and roles. The full form and resulting list below show the controls and the saved result.

4. Test roles with separate logins

Use a separate private browser window for each synthetic account. Check the name in the top-right toolbar so the Administrator session cannot mask a permission problem. As Cedar Contributor, open Posts → Add Post, enter Contributor permission check and a short fictional paragraph, then Save draft. The saved editor offers Submit for Review instead of Publish. Inspect the Author and Editor Dashboards in their own sessions. Then, in each session, open your local site address followed by /wp-admin/plugins.php. WordPress should deny this protected route. A missing menu alone is not the test: the screenshots below show real denial responses for all three roles. Keep these attempts on your own practice site.

5. Check ownership and the editorial handover

As Cedar Author, create Author role test — do not publish publicly. Add one short fictional paragraph and Save draft. Return to Posts and check that the item is Draft and belongs to that author. Keep it out of Navigation. As Cedar Contributor, open the draft’s editor address from your practice record. WordPress denies access to this other user’s draft. Save and exit the writer’s session. Sign in as Cedar Editor and open the same draft from Posts. An earlier session can briefly leave an edit-lock notice. If you see the notice pictured below, confirm that the writer saved and exited before choosing Take over; otherwise choose Exit editor and arrange the handover. The following full editor screenshot shows the draft open for review. Leave it in Draft.

6. Change one role and read back its effect

Return to the Administrator session. Open Users, choose cedar-author, change Role to Contributor, and click Update User at the bottom of the form. Return to Users and confirm the new role. Sign in again as cedar-author and open its saved draft. The account now has Submit for Review instead of Publish. The username stayed the same; the permitted work changed. Save and exit this session before the removal exercise.

7. Remove the test account and retain its draft

As Administrator, return to Users. Hover over cedar-author and choose its individual Delete action. Check that the confirmation names only that synthetic account. Choose Attribute all content to another user, select Cedar Editor, then Confirm Deletion. Read the Users list: cedar-author should be gone. Open Posts and confirm that the ownership-test Draft still exists with Cedar Editor as author. Finally use a fresh login window to try the removed account; WordPress should reject it. Retain Cedar Editor and Cedar Contributor only in this clearly named disposable training site for lessons 42–43. Record their eventual cleanup in the worksheet. This exercise does not grant, remove or approve anyone’s real business access.

Practise

Create the three synthetic roles, test the protected Plugins address in each session, compare draft ownership, change one role, and delete the known test account with explicit content reassignment.

Check your result

Each login has the expected tools and permission boundaries. The removed account cannot log in, its draft remains assigned to the Editor, and the retained training accounts have a recorded cleanup purpose.

Optional notes