How to Make a Subscriber an Admin on WordPress (in Minutes)

To make a subscriber an admin in WordPress, go to Users → All Users, hover the user, click Edit, change the Role dropdown to Administrator and press Update User. It takes about thirty seconds, needs no plugin, and cannot be undone by the person you promoted — which is exactly why it deserves more thought than the click suggests.

This guide covers the dashboard route step by step, the WP-CLI route for when the dashboard is unavailable, what the change actually grants, and how to get back in if you demote the last administrator on the site (a mistake with no undo button).

What you are actually granting

A subscriber has one capability: read. That is why they can log in and see their profile but nothing else — no posts, no settings, no uploads.

An administrator on a single-site install holds every capability WordPress ships with, including install_plugins, activate_plugins, edit_plugins, edit_users, promote_users, manage_options, update_core and unfiltered_html. In practice that means the user can install code onto your server, read and edit theme and plugin files if the file editor is enabled, delete other accounts, and change anything a plugin or theme registers as an admin setting.

WordPress’s own documentation describes administrators as the only role with those capabilities on a single site. There is no audit trail for a role change, and no notification email is sent to anyone when it happens. If you are promoting someone for a short task, decide now how and when you will take the access back. And if the person is not on the site at all yet, create the account first — adding a new member covers the fields, the roles and the notification email.

Method 1: the dashboard

1. Log in as an administrator and go to Users → All Users (or open /wp-admin/users.php directly).
2. Hover the subscriber’s username and click Edit.
3. Scroll to the Role dropdown near the bottom of the page. It lists every role registered on your site — the five defaults plus anything a plugin has added, such as Shop Manager from WooCommerce or a custom role from a membership plugin.
4. Select Administrator and press Update User.
5. The change takes effect on that user’s next page load. No logout is needed, and nothing is emailed to them.

Two things worth knowing before you do it:

• There is no bulk “change role” in core WordPress. A lot of guides describe selecting several users and applying “Change role to…” from the bulk actions menu. That option does not exist in current WordPress — the Users list bulk menu offers only Delete and Send password reset. Bulk role changes come from a plugin.
• The Role field is only visible if you can promote users. If you are an editor or a shop manager, you will see the user’s details but the role dropdown will be missing or greyed out.

Method 2: WP-CLI

If you have SSH access, this is faster and safer than clicking, and it works when the admin screens are broken.

# Who is currently a subscriber
wp user list --role=subscriber \
  --fields=ID,user_login,user_email

# Replace the role, do not add it
wp user set-role 42 administrator

# Confirm the new administrator
wp user list --role=administrator

wp user set-role removes the user’s existing roles and assigns the new one. If you want them to keep the subscriber role as well — which matters for plugins that check roles rather than capabilities — use wp user add-role 42 administrator instead. WordPress users can hold more than one role; set-role and add-role are the two different behaviours and the difference trips people up.

Method 3: a one-off code snippet

Useful when you need to promote a user from inside a plugin or an automation, not by hand. This is the same call the dashboard makes under the hood:

$user = new WP_User( 42 );
if ( $user->exists() ) {
    $user->set_role( 'administrator' );
}

To run it once without a plugin, use wp eval:

wp eval-file promote-user.php

Behind that call, set_role() deletes the old role from the user’s wp_capabilities meta, adds the new one, saves it, and fires the set_user_role hook. If you are writing this into a plugin, hook your check to that action rather than running a role change on every page load.

Subscriber versus administrator, side by side

On multisite, this is different

Two things change on a WordPress network:

• Roles are per site. Making someone an administrator on one site in the network gives them nothing on the others. You repeat the role change on each site where they need it.
• Super Admin is not a role. It is a network-level flag stored separately, and it is granted at Network Admin → Users by an existing super admin. No role dropdown can produce one, and a site administrator on multisite cannot install plugins or themes — only a super admin can, through Network Admin.

If you cannot see the role dropdown

Three usual causes: you are not an administrator yourself, the site is multisite and you are looking at a subsite, or a plugin (usually a membership or security plugin) has filtered the editable roles. On multisite, use the Network Admin → Users screen or a per-site user list; in the other cases, a super admin or site owner has to make the change.

Security: the part most guides skip

Promoting a subscriber to administrator is rarely the problem. Leaving it that way is. Before you close the tab:

1. Give the account a real password and turn on two-factor authentication. An admin account with a reused password is the single most common way WordPress sites are taken over. Solid Security, Wordfence and WP 2FA all provide 2FA without a paid tier.
2. Never share an admin login. Create a separate account per person so removing access later is one click rather than a password reset for everyone.
3. List your admins and confirm each one. wp user list --role=administrator takes a second. Most sites that get cleaned after an incident find an admin account nobody remembers creating.
4. Disable the file editors if you do not use them. define( 'DISALLOW_FILE_EDIT', true ); in wp-config.php removes the theme and plugin editor. Then an admin account cannot turn a stolen password into arbitrary PHP on your server. If you still need to reach plugin files, access them over SFTP or WP-CLI instead.
5. Downgrade when the task is done. Freelancers, contractors and one-off helpers should be administrators for hours, not months.

How to undo it — and how to recover if you lock yourself out

To reverse it, repeat the same steps and set the role back to Subscriber. Fine. The dangerous version is demoting the last administrator: WordPress will happily leave a site with no one who can reach the admin screens, and there is no in-dashboard undo.

Recovery options, in order of preference:

1. WP-CLI — wp user add-role 1 administrator, then log in again.
2. phpMyAdmin — open wp_usermeta, find the row where user_id is your user and meta_key is wp_capabilities, and set meta_value to a:1:{s:13:"administrator";b:1;}. Note the table prefix may not be wp_.
3. A temporary PHP file via SFTP or your host’s file manager, calling set_role() on your user ID and then deleting itself. Only worth doing if the first two are unavailable.

If your site is on a maintenance plan, this is a five-minute fix for whoever manages it; if it is not, it is the kind of outage that costs a morning. Our WordPress maintenance plans include same-day emergency response on the Advanced tier, partly because of situations exactly like this one.

When you need role management at scale

If you are changing roles often, or you need roles that WordPress does not ship with, use a plugin rather than repeating the manual steps:

• Members — free, adds role duplication, per-capability editing and role assignment without touching code. Good default choice.
• User Role Editor — free, similar ground with a more granular capability grid and bulk role changes.

Both can break a site if you strip a capability that something depends on, so take a backup before you start editing roles. If you do not have automated backups yet, that is a bigger risk than any role setting — our guide to installing WordPress plugins safely covers the setup, and security and backup plugins are two of the three worth paying for.

FAQ

Can I promote a subscriber to admin without creating a new account?

Yes. The role belongs to the account, so changing it keeps their username, email, password and any content they own. Nothing is migrated or duplicated.

Why can’t I see Administrator in the role dropdown?

Either you are not an administrator yourself, the role list is filtered by a plugin (common with membership plugins), or you are on a multisite subsite where the relevant control lives in Network Admin.

Does the user need to log out and back in?

No. Capabilities are read from the database on the next request, so a page refresh is enough. Some caching or session plugins delay it, in which case logging out and in forces it.

Is it safe to make a subscriber an admin?

It is safe if the account is a real person you trust, protected by two-factor authentication, and you intend to remove the access when the job is done. It is not safe as a shortcut for a client, a contractor or a support agent who needs one specific setting changed.

What happens if I make someone an admin and they delete the site?

Administrators can delete users, install plugins and (with the file editor enabled) run arbitrary code. Only your backups stand between that and a rebuild. Keep off-site backups that the admin account cannot reach.

Once the role is sorted, the account is the bigger risk: generating a strong password matters more than which role you picked.