How to Add New Members to WordPress (in Minutes)

Adding a member to a WordPress site takes about two minutes: Users → Add New, fill in a username, an email and a password, pick a role, click Add User. WordPress emails the person their login details automatically if you leave the notification box ticked.

That is the whole mechanic. The decisions worth thinking about are which role you grant, whether people should be able to add themselves, and what happens when you have 50 members instead of two. This guide covers the two-minute route first, then those decisions.

Add a member through the dashboard

1. Go to Users → Add New (or open /wp-admin/user-new.php).
2. Enter a Username and an Email. Both are required, and the email must be unique across the site.
3. Add First Name, Last Name and Website if you want them on the member’s profile — optional, and often left blank.
4. Set a password. Clicking Generate password produces a strong one; if you type your own and WordPress rates it weak, you will have to tick Confirm use of weak password before it will save.
5. Leave Send the new user an email about their account ticked. The new member gets a notification with their username and a link to set a password.
6. Choose a Role, then click Add User.

If you untick the notification, the person exists but nobody tells them. Your only ways in are to send them a password reset link yourself from Users → All Users → Send password reset, or to hand them the password out of band.

What each field actually does

Which role to give a “member”

Role is the only security decision on this screen, and the safe default is the lowest one that does the job:

• Subscriber — can log in and edit their own profile, nothing else. Correct for customers, newsletter readers, commenters and anyone who just needs an account.
• Contributor — can write posts but not publish them. Right for guest writers you vet before publishing.
• Author — can publish their own posts. Only for people you would let speak publicly in your name.
• Editor — can publish anyone’s content, moderate comments, manage categories. Staff-level.
• Administrator — full control including plugins, users and settings. Never a default for “member”.

If you are unsure, start at Subscriber and promote later. Demotion is a dropdown change; the damage from an over-privileged account is not reversible the same way. There is a full walkthrough of changing a member’s role if you need to move someone up.

Letting people register themselves

If members should join without you touching anything, enable open registration:

1. Settings → General.
2. Tick Membership: Anyone can register.
3. Set New User Default Role — leave this on Subscriber.
4. Save. WordPress now shows a registration form at /wp-login.php?action=register.

Understand what you have switched on: that form is public and unauthenticated. Bots find it, and every submission becomes a row in your users table and an outgoing email from your server. On a site that does not actually need open registration, leaving it off is the single best spam decision you can make. If you do need it, put a honeypot or CAPTCHA in front of it, and consider requiring email confirmation before the account can do anything.

If registration is on and you are getting junk signups, the fix is a membership plugin (which brings approval queues, email verification and paid tiers) rather than more code in functions.php.

Adding members in bulk

Beyond a handful of people, the dashboard stops being practical:

• CSV import — plugins such as Import Users from CSV or WP All Import map a spreadsheet to user fields, including role, and can email each new account.
• WP-CLI loop — read a CSV on the server and call wp user create per row; no plugin, no upload limits.
• WooCommerce — customers are created automatically at checkout. You do not add them; they add themselves, and they land as Customer, a role that is not the same as Subscriber.
• Membership plugins — MemberPress, Paid Memberships Pro and similar create the user on signup and attach a membership level, which is what “member” usually means in that context.

Adding a member with WP-CLI

# Create a subscriber and email them
wp user create jane [email protected] \
  --role=subscriber \
  --user_pass="$(openssl rand -base64 18)" \
  --send-email

# Everyone with a given role
wp user list --role=subscriber \
  --fields=ID,user_login,user_email

wp user create defaults to the site’s default role if you omit --role, and generates a random password if you omit --user_pass. On most hosts, password login is not how the person will actually get in — the notification email with a reset link is.

Adding a member from code

For integrations, use wp_insert_user() rather than writing to the users table directly:

$user_id = wp_insert_user( array(
    'user_login' => 'jane',
    'user_email' => '[email protected]',
    'user_pass'  => wp_generate_password( 24 ),
    'first_name' => 'Jane',
    'role'       => 'subscriber',
) );

if ( is_wp_error( $user_id ) ) {
    // Username or email already taken, or invalid input.
}

It handles hashing, the user_register hook and the default role logic. It does not send the welcome email — that is wp_new_user_notification(), which you call yourself if you want it.

Multisite: users are network-wide, members are per site

On a multisite install the two ideas split. A user account exists once, across the whole network, but being a member of a site is a separate grant. Super admins add an existing account to a site from Network Admin → Users → Add Existing User, choosing the role they get on that site only. Creating a brand new user from a subsite is not possible for site administrators — that is by design.

Removing or suspending a member

Deleting a user asks what to do with their content: reassign it to another user, or delete it. Choose reassign for anyone who wrote posts; the alternative silently removes published pages from your site. If the person may come back, change their role to Subscriber first or install a plugin that adds a suspended state, rather than deleting the account and losing the audit trail.

Security checklist for member accounts

• Least privilege by default. Subscriber unless proven otherwise.
• Unique emails only. Shared inboxes make password resets indistinguishable.
• Never create accounts with the username “admin”. It is the first guess in every credential-stuffing list.
• Review the user list quarterly. wp user list --role=administrator should return people you can name.
• Enforce strong passwords and two-factor for anyone above Contributor, ideally with a plugin that applies it site-wide.
• Turn off open registration if nobody actually uses it.

Membership lists grow quietly and are rarely audited — which is exactly why abandoned admin accounts are one of the most common ways sites get compromised. That cleanup is part of what our $99 WordPress care plan covers each month, alongside updates, malware scanning and backups. If you are adding members as part of a new site build, start with how to create a WordPress site, and if the accounts need plugin-level access rather than just a login, read how plugin access works first.

FAQ

Do new members get an email automatically?

Yes, if Send the new user an email about their account is ticked when you create them. It contains their username and a link to set a password. If it never arrives, test transactional email on the site — WordPress’s default wp_mail() is unreliable on shared hosting.

Can I add a member without an email address?

Not through the dashboard; email is required and must be unique. It is possible through wp_insert_user() with a placeholder, but then the account has no recovery path and no notification — avoid it.

What is the difference between a user and a member?

Technically none: every member is a WordPress user with a role. Marketing language uses “member” for people with a paid membership level, which is data a membership plugin attaches to the same user account.

How many users can WordPress handle?

Single-site user queries stay fast well into the hundreds of thousands, because WordPress indexes the login and email columns. The practical limit is usually the users screen and any plugin that loads the full list at once, not core.