# Capability reference - Roleline 1.x documentation

> What each of WordPress's capabilities allows, group by group, and which roles have it on a new site.

The role editor describes every capability. This page lists WordPress's own, with the roles that have them on a new WordPress site (A = Administrator, E = Editor, Au = Author, C = Contributor, S = Subscriber).

## Posts

| Capability | Allows | Roles |
|---|---|---|
| `edit_posts` | Write posts and edit their own drafts; opens the Posts screen | A E Au C |
| `edit_others_posts` | Edit posts written by other people | A E |
| `edit_published_posts` | Edit their own posts once published | A E Au |
| `edit_private_posts` | Edit private posts | A E |
| `publish_posts` | Publish and schedule posts (without it, posts go to review) | A E Au |
| `delete_posts` | Delete their own unpublished posts | A E Au C |
| `delete_others_posts` | Delete other people's posts | A E |
| `delete_published_posts` | Delete their own published posts | A E Au |
| `delete_private_posts` | Delete private posts | A E |
| `read_private_posts` | Read private posts | A E |
| `manage_categories` | Add, edit and delete categories and tags | A E |

## Pages

The same set for pages: `edit_pages`, `edit_others_pages`, `edit_published_pages`, `edit_private_pages`, `publish_pages`, `delete_pages`, `delete_others_pages`, `delete_published_pages`, `delete_private_pages`, `read_private_pages`. Administrators and editors have them all.

## Media and comments

| Capability | Allows | Roles |
|---|---|---|
| `upload_files` | Upload files and use the Media Library | A E Au |
| `unfiltered_upload` | Upload any type of file, including ones WordPress blocks | (none by default) |
| `moderate_comments` | Approve, edit, spam and delete comments | A E |

## Users

| Capability | Allows | Roles |
|---|---|---|
| `list_users` | See the Users screen | A |
| `create_users` | Add users | A |
| `edit_users` | Edit other users' profiles, including email and password | A |
| `delete_users` | Delete users | A |
| `promote_users` | Change users' roles | A |
| `remove_users` | Remove users from the site | A |

## Plugins and themes

| Capability | Allows | Roles |
|---|---|---|
| `activate_plugins` | See Plugins; activate and deactivate them | A |
| `install_plugins`, `update_plugins`, `delete_plugins` | Install, update and delete plugins | A |
| `edit_plugins` | Edit plugin code in the editor | A |
| `switch_themes` | Change the theme | A |
| `edit_theme_options` | Customizer, Site Editor, menus and widgets | A |
| `install_themes`, `update_themes`, `delete_themes` | Install, update and delete themes | A |
| `edit_themes` | Edit theme code in the editor | A |

## Settings and core

| Capability | Allows | Roles |
|---|---|---|
| `read` | Log in, see the dashboard and edit their own profile | all |
| `manage_options` | Every setting under Settings: in practice, full control | A |
| `import`, `export` | Tools → Import and Export | A |
| `update_core` | Update WordPress | A |
| `edit_files` | Edit files on the server (used by the file editors) | A |
| `unfiltered_html` | Post any HTML and JavaScript | A E |
| `edit_dashboard` | Change the dashboard's widgets | A |
| `manage_links` | The old Links screen | A E |

On multisite, super admins have every capability, and `unfiltered_html`, `edit_plugins`, `edit_themes` and similar are for super admins only.

## Capabilities that need care

Roleline asks you to confirm before giving these to a role other than Administrator, because anyone with them could take over the site: `manage_options`, `promote_users`, `edit_users`, `create_users`, `delete_users`, `remove_users`, `activate_plugins`, `install_plugins`, `edit_plugins`, `delete_plugins`, `update_plugins`, `install_themes`, `edit_themes`, `delete_themes`, `switch_themes`, `update_core`, `edit_files`, `unfiltered_html`, `unfiltered_upload`, `import`, the network capabilities, `roleline_manage_roles` and `manage_woocommerce`. Developers can change the list with the `roleline_risky_capabilities` filter.

## WooCommerce

WooCommerce adds `manage_woocommerce` (its settings, orders and reports), `view_woocommerce_reports`, and for products, orders, coupons and webhooks the same set as posts (`edit_products`, `edit_others_shop_orders`, `assign_product_terms`…). Its Shop Manager role has them. Roleline lists them under WooCommerce, with descriptions, even while WooCommerce is inactive.

Source: https://extendiment.com/plugins/roleline/docs/1.x/capability-reference