---
title: "Build a WordPress membership site and manage roles and users"
description: "How to build a WordPress membership site: plugins compared with prices, roles vs membership levels, spam-free registration and two-factor authentication."
language: "en"
locale: "en-US"
type: "article"
canonical: "https://www.wp-masquerade.com/wordpress-membership-site-roles-users/"
published: "2026-07-25T06:00:00+00:00"
modified: "2026-11-05T20:53:47+00:00"
translations:
  en-US: "https://www.wp-masquerade.com/wordpress-membership-site-roles-users/index.md"
  fr-FR: "https://www.wp-masquerade.com/fr/espace-membre-wordpress-roles-utilisateurs/index.md"
  es-ES: "https://www.wp-masquerade.com/es/area-miembros-wordpress-roles-usuarios/index.md"
  de-DE: "https://www.wp-masquerade.com/de/wordpress-mitgliederbereich-rollen-benutzer/index.md"
  it-IT: "https://www.wp-masquerade.com/it/area-riservata-wordpress-ruoli-utenti/index.md"
  pt-BR: "https://www.wp-masquerade.com/pt/area-de-membros-wordpress-funcoes-usuarios/index.md"
  nl-NL: "https://www.wp-masquerade.com/nl/wordpress-ledenomgeving-rollen-gebruikers/index.md"
---

# Build a WordPress membership site and manage roles and users

Ultimate Member, Paid Memberships Pro, MemberPress, WooCommerce Memberships or UsersWP: choose the plugin, keep roles and membership levels apart, filter sign-ups and protect your team’s accounts.

A WordPress membership site rests on three building blocks: user accounts, restricted content and, often, payments. The hard part is not installing it, it is keeping members clearly separate from the people who run the site. This guide compares the plugins that do the job, explains how to organise roles and membership levels, and lists the settings that stop a sign-up form from becoming a way in.

## Three kinds of membership site, three needs

- **Community or directory** (association, professional network): public profiles, open or approved registration, not necessarily any payment.
- **Paid content** (courses, premium articles, resources): membership levels, recurring payments, drip access to content.
- **Client portal** (documents, quotes, project tracking): accounts you create yourself, no public registration, content specific to each client.

The third case can often do without a heavy plugin: a dedicated role, protected pages and a login form are enough. The first two justify a specialised plugin.

## Which plugin to choose

| Plugin | Free version | Entry-level paid plan | Best for | Watch out for |
| --- | --- | --- | --- | --- |
| Ultimate Member | Yes: profiles, registration, directory, restriction | $276 per year (1 site) | Community, directory | Public directories: watch what data you expose |
| Paid Memberships Pro | Yes: full, open source core | $499 per year (1 site) | Paid subscriptions | Add-ons reserved for paid plans |
| MemberPress | No | $399 per year, $199.50 the first year | Courses, premium content | Launch plan: 4.9% fee per payment |
| WooCommerce Memberships | No | €178 per year | Existing WooCommerce store | Recurring payments: WooCommerce Subscriptions on top |
| UsersWP | Yes: login, registration, profiles | Paid add-ons | Simple, lightweight area | No built-in payments |

*Vendors’ published prices, excluding tax, for one site. They change often: check before you buy.*

In practice: for an association that takes no payments, the free versions of Ultimate Member or UsersWP are enough. To sell subscriptions, Paid Memberships Pro lets you start for free and pay only for the add-ons you need, whereas MemberPress aims for a turnkey setup. If you already sell with WooCommerce, WooCommerce Memberships saves you a second payment gateway.

*WordPress’s default user roles explained one by one, from Administrator to Subscriber, by WordPress.com (August 2025): a quick way to see what each role can and cannot do before you assign one to your members.*

## Roles, capabilities and membership levels

WordPress gives every account a **role** (Subscriber, Contributor, Author, Editor, Administrator), in other words a set of **capabilities**: `read` to read, `edit_posts` to write, `manage_options` to change site settings. Membership plugins add a second notion, the **membership level** (Free, Premium, Business), stored separately, which decides what content is visible.

Don’t mix the two up: a Premium member is still just a reader as far as WordPress is concerned. They keep the Subscriber role, or an equivalent “Member” role, with the `read` capability only. Giving members the Author role so they can “see more” opens up the dashboard and file uploads to them.

### Create a Member role and keep members out of the dashboard

This code, to be placed in a custom plugin (mu-plugin), creates the role once, hides the toolbar from accounts that don’t write, and sends them back to their account page if they open `wp-admin`:

```
<?php
// "Member" role: read only, created once.
add_action( 'init', function () {
	if ( ! get_role( 'member' ) ) {
		add_role( 'member', 'Member', array( 'read' => true ) );
	}
} );

// No toolbar for accounts that don't write.
add_filter( 'show_admin_bar', function ( $show ) {
	return current_user_can( 'edit_posts' ) ? $show : false;
} );

// wp-admin reserved for the team (AJAX and admin-post still allowed).
add_action( 'admin_init', function () {
	if ( wp_doing_ajax() || 'admin-post.php' === $GLOBALS['pagenow'] ) {
		return;
	}
	if ( ! current_user_can( 'edit_posts' ) ) {
		wp_safe_redirect( home_url( '/my-account/' ) );
		exit;
	}
} );
```

For the team itself (writers, contractors, agency), apply least privilege: the method, role by role, is in our guide to WordPress roles and capabilities.

## A member’s journey, from sign-up to access

*Each step filters something out: bots at registration, fake addresses at confirmation, privileges at the role.*

## Handling registration without opening a hole

- **Default role**: in Settings, General, check that “New User Default Role” is Subscriber or Member. A 2023 Ultimate Member vulnerability let people register straight in as administrators (see [our analysis of CVE-2023-3460](https://www.wp-masquerade.com/ultimate-member-cve-2023-3460-administrators/)): keep the plugin up to date.
- **Bots**: a trap field ([honeypot](https://www.wp-masquerade.com/glossary/honeypot/)), an unobtrusive anti-bot challenge (Cloudflare Turnstile, hCaptcha) and email confirmation get rid of most fake sign-ups. Approve accounts manually if the area is sensitive.
- **Data collected**: ask for the minimum, explain why, set a retention period and delete inactive accounts. WordPress provides personal data export and erasure under Tools.
- **Directories and public profiles**: display neither the login username nor the email address. A visible username makes attacks on the login easier (see [user enumeration](https://www.wp-masquerade.com/wordpress-user-enumeration/)).

## Securing the accounts that matter

A membership site multiplies accounts, and with them passwords reused from one site to the next. The risk is not a hacked member, who only sees their own content, but a hacked administrator or shop manager. So protection is set by role:

| Role | Two-factor authentication | wp-admin access | Other measures |
| --- | --- | --- | --- |
| Administrator | Required | Yes | Named accounts, few of them, activity log |
| Editor, shop manager | Required | Yes | No plugin installation |
| Author, contributor | Recommended | Limited | Controlled file uploads |
| Member, subscriber, customer | Optional | No | Login limiting, strong passwords |

*The more capabilities a role has, the more its protection should be mandatory.*

WP Masquerade Pro handles exactly that: [two-factor authentication required for the roles you choose](https://www.wp-masquerade.com/features/two-factor-authentication/) (the accounts concerned are sent back to their profile until they have set it up), [login attempt limiting](https://www.wp-masquerade.com/features/login-attempt-limiting/) on every login address, and the [activity log](https://www.wp-masquerade.com/features/administrator-activity-log/), which keeps track of role changes and account creation. The free version already moves the login page and hides WordPress traces. It does not replace your membership plugin, nor an anti-spam filter for forms (see [our anti-spam page](https://www.wp-masquerade.com/wordpress-anti-spam/)).

### Two-factor authentication by role, with no hassle for your members

Make it mandatory for the team, leave it optional for members. WP Masquerade Pro from €59 excl. VAT per year for one site, or €990 excl. VAT lifetime for unlimited sites.

[See Pro pricing](https://www.wp-masquerade.com/pricing/)

[Download the free version](https://www.wp-masquerade.com/download/)

## Frequently asked questions

**Can you create a WordPress membership area without a plugin?**

For a simple client portal, yes: a dedicated role, pages protected by an `is_user_logged_in()` condition in the theme, and the WordPress login form. As soon as you need levels, payments or profiles, a plugin is safer than custom code.

**Which role should paying members get?**

Subscriber, or a “Member” role with the read capability only. The paid level is managed by the membership plugin, not by the WordPress role.

**How do you block fake sign-ups?**

Combine a trap field, an unobtrusive anti-bot challenge and email address confirmation. Add manual approval if the area gives access to sensitive information.

**Should members be required to use two-factor authentication?**

Rarely: it slows down registration for little gain. Require it for the roles that run or publish on the site, and offer it to members.

### Key takeaways

- Choose the plugin to fit the need: community, paid content or an existing store.
- WordPress role and membership level are two different things: members stay read-only.
- Keep members out of wp-admin and check the default role for new sign-ups.
- Filter bots at registration and collect as little data as possible.
- Two-factor authentication mandatory for the team, optional for members.

## Sources

- WordPress.org: Roles and Capabilities (https://wordpress.org/documentation/article/roles-and-capabilities/)
- WordPress Developer: add_role() (https://developer.wordpress.org/reference/functions/add_role/)
- Paid Memberships Pro: pricing (https://www.paidmembershipspro.com/pricing/)
- MemberPress: pricing (https://memberpress.com/pricing/)