A WordPress handoff often includes a discussion of who can publish, manage plugins or administer the site. Begin by documenting what the site's role definitions store, then verify the actual workflow on staging. Those are related checks, but they answer different questions.
Creator disclosure: WP Role Capability Review is our own paid plugin from Empire Publishing Tools.
Open Tools > Role Capability Review with an administrator account that also has permission to list users. The read-only report shows five stored role definitions per batch. An exact role-key filter helps focus the discussion on one role without exposing individual accounts.
Look at the true capabilities first. The report highlights a short set of grants worth investigating, such as installing plugins and managing users. A highlight does not mean the role is unsafe. Some teams need those capabilities for legitimate work; record the intended responsibilities before proposing a change.
Next review explicitly false values and unsupported entries. A false stored value does not establish that a particular user is denied access. Non-boolean entries are marked unknown rather than converted into a confident verdict. Custom permission logic may require a developer to trace the authorization path.
WordPress can combine role definitions with user-specific capabilities, permission filters and object-specific checks. Multisite super administrators add another important distinction. Test the actual action using an appropriate staging account; never assume a stored role list fully describes an individual's effective access.
Keep the handoff notes focused on responsibilities and verified behavior. This plugin does not list usernames, email addresses, account counts or role display names. It makes no permission changes and does not send role reports to an external analysis service. Freemius verifies its license separately.
The review has bounds: 100 roles and 500 capability entries per role. Partial results are identified. If a known role falls outside the first batch of definitions, enter its exact role key. Unsupported names remain outside the report's vocabulary rather than being silently rewritten.
Use this report to organize a careful review, not as a security certificate. If a permission change is needed, test it separately on staging, check dependent workflows and keep a recovery path. WP Role Capability Review Pro costs $19/year for one site, with a conditional 14-day refund policy.
Explore WP Role Capability Review and purchase options
Get the AI Edge, Weekly
The tools, tutorials, and trends that actually pay — no hype.
