{"id":1450,"date":"2026-10-16T13:46:03","date_gmt":"2026-10-16T13:46:03","guid":{"rendered":"https:\/\/www.ahosting.net\/blog\/?p=1450"},"modified":"2026-10-19T22:17:53","modified_gmt":"2026-10-19T22:17:53","slug":"open-registration-with-privileged-default-role","status":"publish","type":"post","link":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/","title":{"rendered":"Open Registration With Privileged Default Role? What Site Health Is Telling You"},"content":{"rendered":"\n<script type=\"application\/ld+json\">{\"@context\": \"https:\/\/schema.org\", \"@type\": \"FAQPage\", \"mainEntity\": [{\"@type\": \"Question\", \"name\": \"What does open registration with privileged default role mean in WordPress 2026?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, it means Anyone can register is switched on while New User Default Role is Editor or Administrator, so every new sign-up becomes a privileged user. WordPress added the check in version 7.0, and the role table above shows exactly which values trip it.\"}}, {\"@type\": \"Question\", \"name\": \"Is open registration with privileged default role a real risk when Anyone can register is checked?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Indeed, it is a real risk. The registration form never asks which role a visitor wants, so anyone who can submit it receives the saved default role, unless a plugin adds an approval step of its own. Fixing the default role closes the door, and checking the Users screen shows whether anyone already walked through.\"}}, {\"@type\": \"Question\", \"name\": \"How do I fix open registration with privileged default role in 2026 if Settings will not save?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Typically, something rewrites the option on every request, such as a plugin or a must-use plugin. Set default_role to subscriber in the options table, reload Site Health, and if the value flips back, deactivate plugins one at a time until it stays. The code that writes the option is the real problem to remove.\"}}, {\"@type\": \"Question\", \"name\": \"What are the default user roles in WordPress for new registrations?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, a fresh WordPress install leaves Anyone can register off and sets New User Default Role to Subscriber, as the install defaults in core 7.1.3 show. The five built-in roles are Administrator, Editor, Author, Contributor and Subscriber, and only Subscriber is read-only.\"}}, {\"@type\": \"Question\", \"name\": \"Editor vs Administrator as the default role: which one triggers open registration with privileged default role?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In fact, both do. The test compares default_role to the two strings editor and administrator and turns critical on either match. Administrator is worse, because that role can edit plugins and themes, while Editor can publish any post and save raw HTML.\"}}, {\"@type\": \"Question\", \"name\": \"Subscriber vs Contributor in 2026: which default role is safer after open registration with privileged default role is fixed?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Overall, Subscriber is safer. It holds only the read capability, while Contributor adds edit_posts, which lets every stranger create draft posts inside your admin. Choose Contributor only when you want public submissions and will review each one.\"}}, {\"@type\": \"Question\", \"name\": \"Who can change the options behind open registration with privileged default role on an AHosting account?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Notably, only your site's Administrators, code running inside your site, and anyone with access to your account's database. The two options live in your own WordPress database, so the warning is a question about your site's configuration and access, not about the server.\"}}, {\"@type\": \"Question\", \"name\": \"Can I open a ticket with AHosting about open registration with privileged default role on my site?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Specifically, yes: send the exact line Site Health printed plus the usernames and roles of your Administrator and Editor accounts, with no passwords or email addresses. We will look at it with you. Fix the two options first if you can, because that takes about two minutes.\"}}, {\"@type\": \"Question\", \"name\": \"Do AHosting accounts see the same open registration with privileged default role check as any other host?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"Indeed, because the check lives in WordPress core, not in the server. It behaves the same on any host running WordPress 7.0 or later, and the options it reads are stored in your site's own database wherever it is hosted.\"}}, {\"@type\": \"Question\", \"name\": \"Why does Site Health 7.1.3 pass an Author default role under open registration with privileged default role?\", \"acceptedAnswer\": {\"@type\": \"Answer\", \"text\": \"In fact, the test only lists editor and administrator, so Author, Contributor and every custom role slug pass. An Author can publish posts and upload files, which makes Author a poor default for open sign-ups even though the item stays green.\"}}]}<\/script>\n\n\n<div class=\"wp-block-aioseo-table-of-contents\"><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-open-registration-with-privileged-default-role-what-it-means-in-site-health\">Open Registration With Privileged Default Role: What It Means in Site Health<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-how-open-registration-with-privileged-default-role-gets-set-without-the-settings-screen\">How Open Registration With Privileged Default Role Gets Set Without the Settings Screen<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-how-to-fix-open-registration-with-privileged-default-role-in-two-minutes\">How to Fix Open Registration With Privileged Default Role in Two Minutes<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-change-the-two-options-in-settings-general\">Change the two options in Settings, General<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-read-the-open-registration-options-directly-in-the-database\">Read the open registration options directly in the database<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-check-whether-anyone-used-your-open-registration\">Check Whether Anyone Used Your Open Registration<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-to-do-about-an-account-you-did-not-create\">What to do about an account you did not create<\/a><\/li><\/ul><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-which-default-roles-trigger-the-open-registration-with-privileged-default-role-warning\">Which Default Roles Trigger the Open Registration With Privileged Default Role Warning<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-why-author-and-contributor-pass-the-open-registration-with-privileged-default-role-check\">Why Author and Contributor Pass the Open Registration With Privileged Default Role Check<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-what-site-health-cannot-tell-you-about-open-registration\">What Site Health Cannot Tell You About Open Registration<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-when-open-registration-is-intentional-choosing-a-safe-default\">When Open Registration Is Intentional: Choosing a Safe Default<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-check-your-settings-for-open-registration-with-privileged-default-role\">Check Your Settings for Open Registration With Privileged Default Role<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#aioseo-keep-registration-closed-without-another-plugin\">Keep Registration Closed Without Another Plugin<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-open-registration-with-privileged-default-role\">Frequently Asked Questions About Open Registration With Privileged Default Role<\/a><ul><li><a class=\"aioseo-toc-item\" href=\"#faq-what-does-it-mean-2026\">What does open registration with privileged default role mean in WordPress 2026?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-is-it-a-real-risk\">Is open registration with privileged default role a real risk when Anyone can register is checked?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-fix-when-settings-wont-save\">How do I fix open registration with privileged default role in 2026 if Settings will not save?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-default-user-roles\">What are the default user roles in WordPress for new registrations?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-editor-vs-administrator\">Editor vs Administrator as the default role: which one triggers open registration with privileged default role?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-subscriber-vs-contributor-2026\">Subscriber vs Contributor in 2026: which default role is safer after open registration with privileged default role is fixed?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-who-can-change-the-options\">Who can change the options behind open registration with privileged default role on an AHosting account?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-open-a-ticket\">Can I open a ticket with AHosting about open registration with privileged default role on my site?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-same-check-on-any-host\">Do AHosting accounts see the same open registration with privileged default role check as any other host?<\/a><\/li><li><a class=\"aioseo-toc-item\" href=\"#faq-why-author-passes\">Why does Site Health 7.1.3 pass an Author default role under open registration with privileged default role?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n\n\n<div class=\"ah-tldr\">\n  <span class=\"ah-tldr-badge\">TL;DR<\/span>\n  <p>Open registration with privileged default role means anyone can sign up and become an Editor or Administrator. Set New User Default Role to Subscriber in Settings, General, then check Users for accounts you did not create.<\/p>\n<\/div>\n\n\n\n<figure class=\"wp-block-audio\"><audio preload=\"none\" controls src=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/PODCAST-open-registration-with-privileged-default-role.m4a\"><\/audio><figcaption class=\"wp-element-caption\">Listen: the Site Health registration warning compares two role names, and the Settings screen cannot have set it. By Matt Chrust, Director of Business Development, AHosting.<\/figcaption><\/figure>\n\n\n\n<h2 id=\"aioseo-open-registration-with-privileged-default-role-what-it-means-in-site-health\" class=\"wp-block-heading\">Open Registration With Privileged Default Role: What It Means in Site Health<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Open registration with privileged default role is a critical Security item that WordPress 7.0 added to Tools, Site Health. It appears when two options in your database agree on something dangerous: anyone may register, and every new account lands as an Editor or an Administrator. We read the check in WordPress 7.1.3 to see exactly what it compares, and what we found changes what you should do first.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The short version is a two-minute fix followed by a check you should not skip. This guide covers both, plus a gap in the test itself: it flags two roles and quietly passes three that can still hurt you.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is the mechanism. The option <code>users_can_register<\/code> controls the Anyone can register box, and <code>default_role<\/code> controls New User Default Role. The registration form never asks a visitor which role they want. It calls <code>wp_create_user()<\/code> with a name, a password and an email, and <code>wp_insert_user()<\/code> then fills in the role from <code>default_role<\/code>. Combine a public form with a powerful default, and a stranger gets a privileged account in one submission.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Site Health runs the check as a direct test when the screen loads. It reads both options with <code>get_option()<\/code>, and the item turns critical only when <code>users_can_register<\/code> is truthy and <code>default_role<\/code> is exactly <code>editor<\/code> or <code>administrator<\/code>, per <a href=\"https:\/\/github.com\/WordPress\/WordPress\/blob\/7.1.3\/wp-admin\/includes\/class-wp-site-health.php#L1918\" target=\"_blank\" rel=\"noopener\">the check in WordPress 7.1.3<\/a>. The description it prints reads: Registration is open to anyone, and the default role is set to a privileged role.<\/p>\n\n\n\n<div class=\"ah-infographic\">\n<svg viewBox=\"0 0 760 300\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" role=\"img\" font-family=\"Arial, Helvetica, sans-serif\" aria-label=\"Matrix of five default roles against registration off and on: only Editor and Administrator with registration on are critical\">\n<title>Which default roles Site Health flags<\/title>\n<desc>A two-row grid. With Anyone can register off, all five roles show Good. With it on, Subscriber and Contributor show Good, Author shows Good but can publish, and Editor and Administrator show Critical.<\/desc>\n<rect x=\"0\" y=\"0\" width=\"760\" height=\"300\" rx=\"12\" fill=\"#f8fafc\" stroke=\"#cbd5e1\"\/>\n<text x=\"24\" y=\"34\" font-size=\"17\" font-weight=\"700\" fill=\"#0f172a\">What the Site Health check evaluates<\/text>\n<text x=\"24\" y=\"54\" font-size=\"12\" fill=\"#334155\">Two options: users_can_register and default_role. Result shown by WordPress 7.1.3.<\/text>\n<text x=\"242\" y=\"94\" text-anchor=\"middle\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">Subscriber<\/text>\n<text x=\"358\" y=\"94\" text-anchor=\"middle\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">Contributor<\/text>\n<text x=\"474\" y=\"94\" text-anchor=\"middle\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">Author<\/text>\n<text x=\"590\" y=\"94\" text-anchor=\"middle\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">Editor<\/text>\n<text x=\"706\" y=\"94\" text-anchor=\"middle\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">Administrator<\/text>\n<text x=\"24\" y=\"132\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">Anyone can<\/text>\n<text x=\"24\" y=\"148\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">register: off<\/text>\n<text x=\"24\" y=\"222\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">Anyone can<\/text>\n<text x=\"24\" y=\"238\" font-size=\"13\" font-weight=\"700\" fill=\"#0f172a\">register: on<\/text>\n<rect x=\"190\" y=\"106\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#dcfce7\"\/><text x=\"242\" y=\"137\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#14532d\">Good<\/text>\n<rect x=\"306\" y=\"106\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#dcfce7\"\/><text x=\"358\" y=\"137\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#14532d\">Good<\/text>\n<rect x=\"422\" y=\"106\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#dcfce7\"\/><text x=\"474\" y=\"137\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#14532d\">Good<\/text>\n<rect x=\"538\" y=\"106\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#dcfce7\"\/><text x=\"590\" y=\"137\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#14532d\">Good<\/text>\n<rect x=\"654\" y=\"106\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#dcfce7\"\/><text x=\"706\" y=\"137\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#14532d\">Good<\/text>\n<rect x=\"190\" y=\"196\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#dcfce7\"\/><text x=\"242\" y=\"227\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#14532d\">Good<\/text>\n<rect x=\"306\" y=\"196\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#dcfce7\"\/><text x=\"358\" y=\"227\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#14532d\">Good<\/text>\n<rect x=\"422\" y=\"196\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#fef3c7\"\/><text x=\"474\" y=\"220\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#78350f\">Good<\/text><text x=\"474\" y=\"236\" text-anchor=\"middle\" font-size=\"11\" fill=\"#78350f\">but can publish<\/text>\n<rect x=\"538\" y=\"196\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#fee2e2\"\/><text x=\"590\" y=\"227\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#7f1d1d\">Critical<\/text>\n<rect x=\"654\" y=\"196\" width=\"104\" height=\"52\" rx=\"6\" fill=\"#fee2e2\"\/><text x=\"706\" y=\"227\" text-anchor=\"middle\" font-size=\"15\" font-weight=\"700\" fill=\"#7f1d1d\">Critical<\/text>\n<text x=\"24\" y=\"278\" font-size=\"12\" fill=\"#334155\">Only Editor and Administrator turn the item critical. Amber means the item stays green while the risk remains.<\/text>\n<\/svg>\n<\/div>\n\n\n\n<h2 id=\"aioseo-how-open-registration-with-privileged-default-role-gets-set-without-the-settings-screen\" class=\"wp-block-heading\">How Open Registration With Privileged Default Role Gets Set Without the Settings Screen<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Because the Settings screen no longer lets you choose a privileged default, a site that shows this item had its options written some other way. WordPress 7.0 added a filter named <code>default_role_dropdown_excluded_roles<\/code> and set it to exclude administrator and editor from the dropdown, according to <a href=\"https:\/\/github.com\/WordPress\/WordPress\/blob\/7.1.3\/wp-admin\/options-general.php#L316\" target=\"_blank\" rel=\"noopener\">the General Settings source<\/a>. The one exception is a role that is already saved: it stays in the list so you can see it and change it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">That leaves a short list of ways the combination appears:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>The site chose Editor before the exclusion arrived in WordPress 7.0, and nobody has revisited the value since.<\/li>\n\n\n\n<li>A plugin, theme or code snippet wrote the option with <code>update_option()<\/code>, or a migration or staging copy carried an old value over.<\/li>\n\n\n\n<li>Someone with Administrator or database access edited the row directly.<\/li>\n\n\n\n<li>A snippet emptied the exclusion filter, so the dropdown offers Editor again and an Administrator picked it.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">The check cannot tell you which of these happened. It reads two values and has no history. Treat it as a configuration error until the Users screen says otherwise, and read the account check below before you close the item.<\/p>\n\n\n\n<figure class=\"wp-block-embed is-type-video is-provider-youtube wp-block-embed-youtube wp-embed-aspect-16-9 wp-has-aspect-ratio\"><div class=\"wp-block-embed__wrapper\">\n<div class=\"ah-yt\" data-id=\"wKqiXH086zk\" data-title=\"Open Registration With Privileged Default Role: Fix It (2026)\"><img src=\"https:\/\/i.ytimg.com\/vi\/wKqiXH086zk\/hqdefault.jpg\" alt=\"\" width=\"480\" height=\"360\" loading=\"lazy\" decoding=\"async\"><button type=\"button\" class=\"ah-yt-play\" aria-label=\"Play video: Open Registration With Privileged Default Role: Fix It (2026)\"><span aria-hidden=\"true\"><\/span><\/button><\/div>\n<\/div><\/figure>\n\n\n\n<h2 id=\"aioseo-how-to-fix-open-registration-with-privileged-default-role-in-two-minutes\" class=\"wp-block-heading\">How to Fix Open Registration With Privileged Default Role in Two Minutes<\/h2>\n\n\n\n<h3 id=\"aioseo-change-the-two-options-in-settings-general\" class=\"wp-block-heading\">Change the two options in Settings, General<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Log in as an Administrator and open Settings, then General.<\/li>\n\n\n\n<li>Find the Membership row. If you do not need public sign-ups, untick Anyone can register.<\/li>\n\n\n\n<li>If you do need sign-ups, set New User Default Role to Subscriber.<\/li>\n\n\n\n<li>Click Save Changes, then reload Tools, Site Health and open the Status tab to run the check again.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">On a Multisite network the Membership row does not appear on the single-site General screen, because the source only renders it when <code>is_multisite()<\/code> is false. The test still reads the site-level options on a network, and its Change these settings link points to that same screen, so network owners will need the database method below.<\/p>\n\n\n\n<h3 id=\"aioseo-read-the-open-registration-options-directly-in-the-database\" class=\"wp-block-heading\">Read the open registration options directly in the database<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If the Settings screen will not load or will not save, read the values where they live. In phpMyAdmin or any database tool your plan gives you, open the options table and run <code>SELECT option_name, option_value FROM wp_options WHERE option_name IN ('users_can_register', 'default_role');<\/code>. Your table prefix may differ from <code>wp_<\/code>, but the two option names are the same on every site.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A value of <code>1<\/code> in <code>users_can_register<\/code> means the form is open, and <code>subscriber<\/code> is the safe default. If a value flips back after you change it, something writes it on every request. A plugin or must-use plugin is the usual suspect, so deactivate plugins one at a time until the value stays put.<\/p>\n\n\n\n<h2 id=\"aioseo-check-whether-anyone-used-your-open-registration\" class=\"wp-block-heading\">Check Whether Anyone Used Your Open Registration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Fixing the settings closes the door. It does not tell you who already walked through, so check the accounts before you move on. Open Users, then All Users, and use the Administrator and Editor links above the list. Open every account you do not recognize and read its role on the profile screen.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The database gives a faster view of the newest accounts. Run <code>SELECT ID, user_login, user_registered FROM wp_users ORDER BY user_registered DESC LIMIT 20;<\/code> to list the twenty most recent sign-ups with their registration time. The <code>user_registered<\/code> column exists in the core schema, so the query works on every install.<\/p>\n\n\n\n<h3 id=\"aioseo-what-to-do-about-an-account-you-did-not-create\" class=\"wp-block-heading\">What to do about an account you did not create<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If an unknown Administrator or Editor exists, treat the site as exposed and work through these steps in order:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Write down the unknown account&#8217;s username and registration time before you touch anything.<\/li>\n\n\n\n<li>Change the password of every real Administrator, and use Log Out Everywhere Else on each profile.<\/li>\n\n\n\n<li>Reassign any content the unknown account owns, then delete the account.<\/li>\n\n\n\n<li>Open Plugins and Appearance, Themes and look for anything you did not install, because an Administrator can add both.<\/li>\n\n\n\n<li>Restore from a clean backup if you have one that predates the account.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Then fix the two options so the same thing cannot happen again. <a href=\"https:\/\/cwe.mitre.org\/data\/definitions\/269.html\" target=\"_blank\" rel=\"noopener\">CWE-269, Improper Privilege Management<\/a>, is the name security teams give to handing an account more access than it needs, and this check is a small, specific guard against it.<\/p>\n\n\n\n<h2 id=\"aioseo-which-default-roles-trigger-the-open-registration-with-privileged-default-role-warning\" class=\"wp-block-heading\">Which Default Roles Trigger the Open Registration With Privileged Default Role Warning<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The role you pick decides what a stranger can do in the first minute. The table below turns the capability grants in WordPress 7.1.3 into plain terms and shows which rows the check flags. It is our reading of the core role definitions for a single-site install.<\/p>\n\n\n\n<figure class=\"wp-block-table ah-ladder\"><table><thead><tr><th>Default role<\/th><th>Site Health result<\/th><th>What a stranger can do on day one<\/th><th>Capabilities granted by core<\/th><\/tr><\/thead><tbody><tr><td>Administrator<\/td><td>Critical<\/td><td>Take over the site: activate and edit plugins, edit themes, change settings, edit other users<\/td><td><code>activate_plugins<\/code>, <code>edit_plugins<\/code>, <code>edit_themes<\/code>, <code>edit_users<\/code>, <code>manage_options<\/code><\/td><\/tr><tr><td>Editor<\/td><td>Critical<\/td><td>Publish and edit any post, upload files, save raw HTML<\/td><td><code>edit_others_posts<\/code>, <code>publish_posts<\/code>, <code>upload_files<\/code>, <code>unfiltered_html<\/code><\/td><\/tr><tr><td>Author<\/td><td>Good (not flagged)<\/td><td>Publish and edit their own posts and upload files<\/td><td><code>publish_posts<\/code>, <code>edit_published_posts<\/code>, <code>upload_files<\/code><\/td><\/tr><tr><td>Contributor<\/td><td>Good (not flagged)<\/td><td>Write posts and submit them, but not publish<\/td><td><code>edit_posts<\/code><\/td><\/tr><tr><td>Subscriber<\/td><td>Good (not flagged)<\/td><td>Read only, and manage their own profile<\/td><td><code>read<\/code><\/td><\/tr><\/tbody><\/table><figcaption class=\"wp-element-caption\">AHosting Default Role Risk Table: which WordPress 7.1.3 default roles the open registration check flags, and what each grants. Source: wp-admin\/includes\/schema.php, populate_roles_160().<\/figcaption><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">Read the table from the bottom up. Each step adds a power, and the check draws its line above Author. The line is reasonable for a quick warning, but it is not the line a careful site owner would draw. The role definitions are also documented in the <a href=\"https:\/\/wordpress.org\/documentation\/article\/roles-and-capabilities\/\" target=\"_blank\" rel=\"noopener\">WordPress roles and capabilities guide<\/a>, which lists the full capability set for every role.<\/p>\n\n\n\n<h2 id=\"aioseo-why-author-and-contributor-pass-the-open-registration-with-privileged-default-role-check\" class=\"wp-block-heading\">Why Author and Contributor Pass the Open Registration With Privileged Default Role Check<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The test is a strict comparison against two role names. In code terms it asks whether <code>default_role<\/code> is in the list <code>editor<\/code>, <code>administrator<\/code>, and nothing else. That has two consequences you should know about.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">First, Author passes. A site with Anyone can register on and Author as the default shows a green item, yet every stranger who signs up can publish posts and upload files. Green here does not mean safe.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Second, custom roles pass. Membership and course plugins create their own role slugs, and the test compares the slug, not the capabilities behind it. A role named <code>member<\/code> that carries every Editor capability looks identical to a harmless one. Open the plugin that created the role and read what it grants.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The principle behind both cases is least privilege: give an account only what its job needs. The <a href=\"https:\/\/cheatsheetseries.owasp.org\/cheatsheets\/Authorization_Cheat_Sheet.html\" target=\"_blank\" rel=\"noopener\">OWASP Authorization Cheat Sheet<\/a> puts it as a design rule, and for open sign-ups it reduces to one line. Choose Subscriber unless you have a written reason for anything else.<\/p>\n\n\n\n<h2 id=\"aioseo-what-site-health-cannot-tell-you-about-open-registration\" class=\"wp-block-heading\">What Site Health Cannot Tell You About Open Registration<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The item is a two-value comparison, so it misses several things a careful owner would want to know. It does not look at your existing accounts, so a site that was already abused still shows green once the options are fixed. It does not check whether new sign-ups must confirm an email address or pass any approval step.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The test also reads only the site-level <code>users_can_register<\/code> option. On a Multisite network, new-site registration is controlled by a separate network setting that the source reads with <code>get_site_option()<\/code> in a different file, and this test never looks at it. Treat the item as a prompt to review your sign-up setup, not as a verdict on it.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Finally, a passed check says nothing about plugins that run their own registration forms. A form from a plugin can create accounts with any role the plugin chooses, whatever your General settings say. If you use such a plugin, read its role setting in the plugin itself.<\/p>\n\n\n\n<h2 id=\"aioseo-when-open-registration-is-intentional-choosing-a-safe-default\" class=\"wp-block-heading\">When Open Registration Is Intentional: Choosing a Safe Default<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Some sites need public sign-ups: communities, course sites, member areas and shops. The check is not telling you to close registration. It is telling you not to hand out Editor or Administrator while registration is open. For an intentional sign-up form, the safe pattern is short.<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Leave New User Default Role on Subscriber, so a new account can do nothing but read.<\/li>\n\n\n\n<li>Grant any higher role by hand or through a plugin rule you have read, never through the default.<\/li>\n\n\n\n<li>Review the newest accounts on a schedule, using the database query above or the Users screen.<\/li>\n\n\n\n<li>Read the capabilities of any custom role before you accept it as a default, because the test will not.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">If a membership plugin insists on its own default role, that is a decision about what a stranger should be allowed to do in the first minute. Make it deliberately, with the role table above beside you.<\/p>\n\n\n\n<h2 id=\"aioseo-check-your-settings-for-open-registration-with-privileged-default-role\" class=\"wp-block-heading\">Check Your Settings for Open Registration With Privileged Default Role<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Pick your two settings below. The checker applies the same logic as the WordPress 7.1.3 test, then adds the verdict the test leaves out for Author, Contributor and custom roles.<\/p>\n\n\n\n<style>\n.ahrr-tool{border:1px solid #cbd5e1;border-radius:12px;padding:20px;margin:24px 0;background:#ffffff;color:#0f172a}\n.ahrr-tool h3{margin:0 0 12px;font-size:1.2rem;color:#0f172a}\n.ahrr-tool label{display:block;font-weight:600;margin:12px 0 4px;color:#0f172a}\n.ahrr-tool select{width:100%;max-width:360px;padding:8px;border:1px solid #64748b;border-radius:6px;font-size:1rem;color:#0f172a;background:#ffffff}\n.ahrr-out{margin-top:16px;padding:14px;border-radius:8px;border:1px solid #cbd5e1;background:#f8fafc;color:#0f172a}\n.ahrr-out strong{display:block;margin-bottom:6px}\n.ahrr-out.ahrr-bad{background:#fee2e2;border-color:#b91c1c;color:#7f1d1d}\n.ahrr-out.ahrr-warn{background:#fef3c7;border-color:#b45309;color:#78350f}\n.ahrr-out.ahrr-ok{background:#dcfce7;border-color:#15803d;color:#14532d}\na.ahrr-btn.wp-element-button{display:inline-block;margin-top:14px;padding:10px 18px;border-radius:8px;background:#2563eb !important;color:#ffffff !important;text-decoration:none !important;font-weight:600}\n<\/style>\n<div class=\"ahrr-tool\" data-ahrr=\"registration-role\">\n  <h3>Registration and Default Role Checker<\/h3>\n  <label for=\"ahrr-reg\">Anyone can register<\/label>\n  <select id=\"ahrr-reg\">\n    <option value=\"off\">Off (unchecked)<\/option>\n    <option value=\"on\">On (checked)<\/option>\n  <\/select>\n  <label for=\"ahrr-role\">New User Default Role<\/label>\n  <select id=\"ahrr-role\">\n    <option value=\"subscriber\">Subscriber<\/option>\n    <option value=\"contributor\">Contributor<\/option>\n    <option value=\"author\">Author<\/option>\n    <option value=\"editor\">Editor<\/option>\n    <option value=\"administrator\">Administrator<\/option>\n    <option value=\"custom\">A custom role from a plugin<\/option>\n  <\/select>\n  <div class=\"ahrr-out ahrr-ok\" id=\"ahrr-out\" aria-live=\"polite\"><strong id=\"ahrr-head\"><\/strong><span id=\"ahrr-body\"><\/span><\/div>\n  <a class=\"ahrr-btn wp-element-button\" href=\"https:\/\/www.ahosting.net\/wordpress-hosting.html\">See AHosting WordPress hosting<\/a>\n<\/div>\n<script>(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var root = document.querySelector('.ahrr-tool');\n    if (!root) { return; }\n    var id = root.getAttribute('data-ahrr');\n    if (!id) { return; }\n    var reg = document.getElementById('ahrr-reg');\n    var role = document.getElementById('ahrr-role');\n    var out = document.getElementById('ahrr-out');\n    var head = document.getElementById('ahrr-head');\n    var body = document.getElementById('ahrr-body');\n    if (!reg) { return; }\n    if (!role) { return; }\n    if (!out) { return; }\n    if (!head) { return; }\n    if (!body) { return; }\n    function show(cls, h, b) {\n      out.className = 'ahrr-out ' + cls;\n      head.textContent = h;\n      body.textContent = b;\n    }\n    function update() {\n      var open = reg.value === 'on';\n      var r = role.value;\n      if (!open) {\n        show('ahrr-ok', 'Site Health: good', 'Registration is closed, so the check passes whatever the default role says. Keep it closed unless you need public sign-ups.');\n        return;\n      }\n      if (r === 'administrator') {\n        show('ahrr-bad', 'Site Health: critical', 'Every visitor who registers becomes an Administrator. Set New User Default Role to Subscriber now, then review the Users screen.');\n        return;\n      }\n      if (r === 'editor') {\n        show('ahrr-bad', 'Site Health: critical', 'Every visitor who registers becomes an Editor and can publish any post and save raw HTML. Set the role to Subscriber now, then review the Users screen.');\n        return;\n      }\n      if (r === 'author') {\n        show('ahrr-warn', 'Site Health: good, but not safe', 'The check does not list Author, yet every stranger can publish posts and upload files. Choose Subscriber.');\n        return;\n      }\n      if (r === 'contributor') {\n        show('ahrr-warn', 'Site Health: good, with a caveat', 'Strangers can create draft posts in your admin but cannot publish them. Choose Subscriber unless you want public submissions.');\n        return;\n      }\n      if (r === 'custom') {\n        show('ahrr-warn', 'Site Health: good, but check the role', 'The test compares the role name only. Open the plugin that created the role and confirm what it can do.');\n        return;\n      }\n      show('ahrr-ok', 'Site Health: good', 'Subscriber can only read. This is the WordPress default and the safest choice for open sign-ups.');\n    }\n    reg.addEventListener('change', update);\n    role.addEventListener('change', update);\n    update();\n  });\n})();<\/script>\n\n\n\n<h2 id=\"aioseo-keep-registration-closed-without-another-plugin\" class=\"wp-block-heading\">Keep Registration Closed Without Another Plugin<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">A fresh WordPress install is safe on both options. The core install defaults set <code>users_can_register<\/code> to 0 and <code>default_role<\/code> to subscriber, so every dangerous combination is something that was changed afterward. That is why this item deserves attention even though it takes two minutes to fix.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you do run public sign-ups, keep Subscriber as the default and promote people by hand. Our guide to <a href=\"https:\/\/www.ahosting.net\/blog\/five-ways-you-can-keep-your-wordpress-site-spam-free\/\">keeping a WordPress site spam-free<\/a> covers registration controls and server-level blocking.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Account isolation limits the damage if one site is compromised, as we explain in <a href=\"https:\/\/www.ahosting.net\/blog\/wordpress-hosting-security-2026-server-level-protection\/\">WordPress hosting security beyond plugins<\/a>. Two other Site Health items have their own guides: <a href=\"https:\/\/www.ahosting.net\/blog\/log-errors-to-a-potentially-public-file\/\">the potentially public log file warning<\/a> and <a href=\"https:\/\/www.ahosting.net\/blog\/your-site-may-have-problems-auto-updating-plugins-and-themes\/\">the auto-update problem check<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If the Site Health line or the account list still does not make sense, open a ticket with the exact line Site Health printed and the usernames and roles of your Administrator and Editor accounts, with no passwords or email addresses, and we will look at it with you. The WordPress default of Subscriber applies on every plan, from <a href=\"https:\/\/www.ahosting.net\/web-hosting.html\">web hosting<\/a> to a shop on <a href=\"https:\/\/www.ahosting.net\/woocommerce-hosting.html\">WooCommerce hosting<\/a>.<\/p>\n\n\n\n<h2 id=\"faq-open-registration-with-privileged-default-role\" class=\"wp-block-heading\">Frequently Asked Questions About Open Registration With Privileged Default Role<\/h2>\n\n\n\n<h3 id=\"faq-what-does-it-mean-2026\" class=\"wp-block-heading\">What does open registration with privileged default role mean in WordPress 2026?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, it means Anyone can register is switched on while New User Default Role is Editor or Administrator, so every new sign-up becomes a privileged user. WordPress added the check in version 7.0, and the role table above shows exactly which values trip it.<\/p>\n\n\n\n<h3 id=\"faq-is-it-a-real-risk\" class=\"wp-block-heading\">Is open registration with privileged default role a real risk when Anyone can register is checked?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Indeed, it is a real risk. The registration form never asks which role a visitor wants, so anyone who can submit it receives the saved default role, unless a plugin adds an approval step of its own. Fixing the default role closes the door, and checking the Users screen shows whether anyone already walked through.<\/p>\n\n\n\n<h3 id=\"faq-fix-when-settings-wont-save\" class=\"wp-block-heading\">How do I fix open registration with privileged default role in 2026 if Settings will not save?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Typically, something rewrites the option on every request, such as a plugin or a must-use plugin. Set default_role to subscriber in the options table, reload Site Health, and if the value flips back, deactivate plugins one at a time until it stays. The code that writes the option is the real problem to remove.<\/p>\n\n\n\n<h3 id=\"faq-default-user-roles\" class=\"wp-block-heading\">What are the default user roles in WordPress for new registrations?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, a fresh WordPress install leaves Anyone can register off and sets New User Default Role to Subscriber, as the install defaults in core 7.1.3 show. The five built-in roles are Administrator, Editor, Author, Contributor and Subscriber, and only Subscriber is read-only.<\/p>\n\n\n\n<h3 id=\"faq-editor-vs-administrator\" class=\"wp-block-heading\">Editor vs Administrator as the default role: which one triggers open registration with privileged default role?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In fact, both do. The test compares default_role to the two strings editor and administrator and turns critical on either match. Administrator is worse, because that role can edit plugins and themes, while Editor can publish any post and save raw HTML.<\/p>\n\n\n\n<h3 id=\"faq-subscriber-vs-contributor-2026\" class=\"wp-block-heading\">Subscriber vs Contributor in 2026: which default role is safer after open registration with privileged default role is fixed?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Overall, Subscriber is safer. It holds only the read capability, while Contributor adds edit_posts, which lets every stranger create draft posts inside your admin. Choose Contributor only when you want public submissions and will review each one.<\/p>\n\n\n\n<h3 id=\"faq-who-can-change-the-options\" class=\"wp-block-heading\">Who can change the options behind open registration with privileged default role on an AHosting account?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Notably, only your site&#8217;s Administrators, code running inside your site, and anyone with access to your account&#8217;s database. The two options live in your own WordPress database, so the warning is a question about your site&#8217;s configuration and access, not about the server.<\/p>\n\n\n\n<h3 id=\"faq-open-a-ticket\" class=\"wp-block-heading\">Can I open a ticket with AHosting about open registration with privileged default role on my site?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Specifically, yes: send the exact line Site Health printed plus the usernames and roles of your Administrator and Editor accounts, with no passwords or email addresses. We will look at it with you. Fix the two options first if you can, because that takes about two minutes.<\/p>\n\n\n\n<h3 id=\"faq-same-check-on-any-host\" class=\"wp-block-heading\">Do AHosting accounts see the same open registration with privileged default role check as any other host?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Indeed, because the check lives in WordPress core, not in the server. It behaves the same on any host running WordPress 7.0 or later, and the options it reads are stored in your site&#8217;s own database wherever it is hosted.<\/p>\n\n\n\n<h3 id=\"faq-why-author-passes\" class=\"wp-block-heading\">Why does Site Health 7.1.3 pass an Author default role under open registration with privileged default role?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In fact, the test only lists editor and administrator, so Author, Contributor and every custom role slug pass. An Author can publish posts and upload files, which makes Author a poor default for open sign-ups even though the item stays green.<\/p>\n\n\n\n<script>\n(function(){\n  document.addEventListener('DOMContentLoaded', function(){\n    var allH3s = document.querySelectorAll('h3.wp-block-heading');\n    var inFaq = false;\n    for (var i = 0; i < allH3s.length; i++) {\n      var h3 = allH3s[i];\n      var prev = h3.previousElementSibling;\n      if (prev) {\n        if (prev.tagName === 'H2') {\n          var prevId = prev.getAttribute('id');\n          if (prevId) {\n            if (prevId.indexOf('faq-') === 0) {\n              inFaq = true;\n            } else {\n              inFaq = false;\n            }\n          }\n        }\n      }\n      if (inFaq) {\n        initToggle(h3);\n      }\n    }\n    function initToggle(h3) {\n      var answer = h3.nextElementSibling;\n      if (!answer) { return; }\n      if (answer.tagName !== 'P') { return; }\n      answer.style.display = 'none';\n      h3.style.cursor = 'pointer';\n      h3.setAttribute('tabindex', '0');\n      h3.setAttribute('aria-expanded', 'false');\n      h3.addEventListener('click', function(){\n        toggleOne(h3, answer);\n      });\n      h3.addEventListener('keydown', function(ev){\n        if (ev.key === 'Enter') { toggleOne(h3, answer); }\n        if (ev.key === ' ') { ev.preventDefault(); toggleOne(h3, answer); }\n      });\n    }\n    function toggleOne(h3, answer) {\n      var open = h3.getAttribute('aria-expanded') === 'true';\n      if (open) {\n        answer.style.display = 'none';\n        h3.setAttribute('aria-expanded', 'false');\n      } else {\n        answer.style.display = 'block';\n        h3.setAttribute('aria-expanded', 'true');\n      }\n    }\n  });\n})();\n<\/script>\n","protected":false},"excerpt":{"rendered":"<p>TL;DR Open registration with privileged default role means anyone can sign up and become an Editor or Administrator. Set New User Default Role to Subscriber in Settings, General, then check Users for accounts you did not create. Open Registration With Privileged Default Role: What It Means in Site Health Open registration with privileged default role [&hellip;]<\/p>\n","protected":false},"author":2,"featured_media":1451,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[8],"tags":[314,110,276,315,27,113,138,117],"class_list":["post-1450","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wordpress","tag-open-registration-with-privileged-default-role","tag-shared-hosting","tag-site-health","tag-user-roles","tag-wordpress","tag-wordpress-errors","tag-wordpress-security","tag-wordpress-troubleshooting"],"aioseo_notices":[],"aioseo_head":"\n\t\t<!-- All in One SEO 5.0.4 - aioseo.com -->\n\t<meta name=\"description\" content=\"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.\" \/>\n\t<meta name=\"robots\" content=\"max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n\t<meta name=\"author\" content=\"Matt Chrust\"\/>\n\t<link rel=\"canonical\" href=\"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/\" \/>\n\t\t<meta name=\"generator\" content=\"All in One SEO (AIOSEO) 5.0.4\" \/>\n\t\t<meta property=\"og:locale\" content=\"en_US\" \/>\n\t\t<meta property=\"og:site_name\" content=\"AHosting Blog | WordPress Hosting Tips &amp; Guides\" \/>\n\t\t<meta property=\"og:type\" content=\"article\" \/>\n\t\t<meta property=\"og:title\" content=\"Open Registration With Privileged Default Role | AHosting\" \/>\n\t\t<meta property=\"og:description\" content=\"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.\" \/>\n\t\t<meta property=\"og:url\" content=\"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/\" \/>\n\t\t<meta property=\"og:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/open-registration-with-privileged-default-role-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:secure_url\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/open-registration-with-privileged-default-role-ahosting.jpg\" \/>\n\t\t<meta property=\"og:image:width\" content=\"1200\" \/>\n\t\t<meta property=\"og:image:height\" content=\"675\" \/>\n\t\t<meta property=\"article:published_time\" content=\"2026-10-16T13:46:03+00:00\" \/>\n\t\t<meta property=\"article:modified_time\" content=\"2026-10-19T22:17:53+00:00\" \/>\n\t\t<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n\t\t<meta name=\"twitter:site\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:title\" content=\"Open Registration With Privileged Default Role | AHosting\" \/>\n\t\t<meta name=\"twitter:description\" content=\"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.\" \/>\n\t\t<meta name=\"twitter:creator\" content=\"@ahostingdotnet\" \/>\n\t\t<meta name=\"twitter:image\" content=\"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/open-registration-with-privileged-default-role-ahosting.jpg\" \/>\n\t\t<script type=\"application\/ld+json\" class=\"aioseo-schema\">\n\t\t\t{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"BlogPosting\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#article\",\"name\":\"Open Registration With Privileged Default Role | AHosting\",\"headline\":\"Open Registration With Privileged Default Role? What Site Health Is Telling You\",\"author\":{\"@type\":\"Person\",\"name\":\"Matt Chrust\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\"},\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/open-registration-with-privileged-default-role-ahosting.jpg\",\"width\":1200,\"height\":675,\"caption\":\"Open registration with privileged default role: Site Health flags two roles and passes the rest. By Matt Chrust, Director of Business Development, AHosting.\"},\"datePublished\":\"2026-10-16T13:46:03+00:00\",\"dateModified\":\"2026-10-19T22:17:53+00:00\",\"inLanguage\":\"en-US\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#webpage\"},\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#webpage\"},\"articleSection\":\"WordPress, open registration with privileged default role, Shared Hosting, Site Health, user roles, WordPress, WordPress errors, wordpress security, WordPress troubleshooting\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#breadcrumblist\",\"itemListElement\":[{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#listItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"position\":2,\"name\":\"WordPress\",\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/\",\"nextItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#listItem\",\"name\":\"Open Registration With Privileged Default Role? What Site Health Is Telling You\"},\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#listItem\",\"name\":\"Home\"}},{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#listItem\",\"position\":3,\"name\":\"Open Registration With Privileged Default Role? What Site Health Is Telling You\",\"previousItem\":{\"@type\":\"ListItem\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/category\\\/wordpress\\\/#listItem\",\"name\":\"WordPress\"},\"item\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/\"}]},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\",\"name\":\"AHosting\",\"description\":\"WordPress Hosting Tips & Guides\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/assets\\\/img\\\/ahosting-logo.svg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#organizationLogo\"},\"image\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#organizationLogo\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/ahostingdotnet\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/\",\"name\":\"Matt Chrust\",\"image\":{\"@type\":\"ImageObject\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#authorImage\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g\",\"width\":96,\"height\":96,\"caption\":\"Matt Chrust\"}},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#webpage\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/\",\"name\":\"Open Registration With Privileged Default Role | AHosting\",\"description\":\"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.\",\"inLanguage\":\"en-US\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/#website\"},\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#breadcrumblist\"},\"author\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"creator\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/author\\\/matt-chrust\\\/#author\"},\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/wp-content\\\/uploads\\\/2026\\\/10\\\/open-registration-with-privileged-default-role-ahosting.jpg\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#mainImage\",\"width\":1200,\"height\":675,\"caption\":\"Open registration with privileged default role: Site Health flags two roles and passes the rest. By Matt Chrust, Director of Business Development, AHosting.\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/blog\\\/open-registration-with-privileged-default-role\\\/#mainImage\"},\"datePublished\":\"2026-10-16T13:46:03+00:00\",\"dateModified\":\"2026-10-19T22:17:53+00:00\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#website\",\"url\":\"https:\\\/\\\/www.ahosting.net\\\/\",\"name\":\"AHosting\",\"description\":\"WordPress Hosting Tips & Guides\",\"inLanguage\":\"en-US\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.ahosting.net\\\/#organization\"}}]}\n\t\t<\/script>\n\t\t<!-- All in One SEO -->\n\n","aioseo_head_json":{"title":"Open Registration With Privileged Default Role | AHosting","description":"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.","canonical_url":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/","robots":"max-snippet:-1, max-image-preview:large, max-video-preview:-1","keywords":"","webmasterTools":{"miscellaneous":""},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"BlogPosting","@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#article","name":"Open Registration With Privileged Default Role | AHosting","headline":"Open Registration With Privileged Default Role? What Site Health Is Telling You","author":{"@type":"Person","name":"Matt Chrust","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/"},"publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/open-registration-with-privileged-default-role-ahosting.jpg","width":1200,"height":675,"caption":"Open registration with privileged default role: Site Health flags two roles and passes the rest. By Matt Chrust, Director of Business Development, AHosting."},"datePublished":"2026-10-16T13:46:03+00:00","dateModified":"2026-10-19T22:17:53+00:00","inLanguage":"en-US","mainEntityOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#webpage"},"isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#webpage"},"articleSection":"WordPress, open registration with privileged default role, Shared Hosting, Site Health, user roles, WordPress, WordPress errors, wordpress security, WordPress troubleshooting"},{"@type":"BreadcrumbList","@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#breadcrumblist","itemListElement":[{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/#listItem","position":1,"name":"Home","item":"https:\/\/www.ahosting.net\/blog\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","position":2,"name":"WordPress","item":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/","nextItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#listItem","name":"Open Registration With Privileged Default Role? What Site Health Is Telling You"},"previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/#listItem","name":"Home"}},{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#listItem","position":3,"name":"Open Registration With Privileged Default Role? What Site Health Is Telling You","previousItem":{"@type":"ListItem","@id":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/#listItem","name":"WordPress"},"item":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/"}]},{"@type":"Organization","@id":"https:\/\/www.ahosting.net\/#organization","name":"AHosting","description":"WordPress Hosting Tips & Guides","url":"https:\/\/www.ahosting.net\/","logo":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/assets\/img\/ahosting-logo.svg","@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#organizationLogo"},"image":{"@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#organizationLogo"},"sameAs":["https:\/\/x.com\/ahostingdotnet"]},{"@type":"Person","@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author","url":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/","name":"Matt Chrust","image":{"@type":"ImageObject","@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#authorImage","url":"https:\/\/secure.gravatar.com\/avatar\/795895edac1c44589f6c7f5e6bb79df405fbbaac15817bdd387ec57da61731ec?s=96&d=mm&r=g","width":96,"height":96,"caption":"Matt Chrust"}},{"@type":"WebPage","@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#webpage","url":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/","name":"Open Registration With Privileged Default Role | AHosting","description":"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.","inLanguage":"en-US","isPartOf":{"@id":"https:\/\/www.ahosting.net\/blog\/#website"},"breadcrumb":{"@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#breadcrumblist"},"author":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"creator":{"@id":"https:\/\/www.ahosting.net\/blog\/author\/matt-chrust\/#author"},"image":{"@type":"ImageObject","url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/open-registration-with-privileged-default-role-ahosting.jpg","@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#mainImage","width":1200,"height":675,"caption":"Open registration with privileged default role: Site Health flags two roles and passes the rest. By Matt Chrust, Director of Business Development, AHosting."},"primaryImageOfPage":{"@id":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/#mainImage"},"datePublished":"2026-10-16T13:46:03+00:00","dateModified":"2026-10-19T22:17:53+00:00"},{"@type":"WebSite","@id":"https:\/\/www.ahosting.net\/#website","url":"https:\/\/www.ahosting.net\/","name":"AHosting","description":"WordPress Hosting Tips & Guides","inLanguage":"en-US","publisher":{"@id":"https:\/\/www.ahosting.net\/#organization"}}]},"og:locale":"en_US","og:site_name":"AHosting Blog | WordPress Hosting Tips &amp; Guides","og:type":"article","og:title":"Open Registration With Privileged Default Role | AHosting","og:description":"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.","og:url":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/","og:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/open-registration-with-privileged-default-role-ahosting.jpg","og:image:secure_url":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/open-registration-with-privileged-default-role-ahosting.jpg","og:image:width":1200,"og:image:height":675,"article:published_time":"2026-10-16T13:46:03+00:00","article:modified_time":"2026-10-19T22:17:53+00:00","twitter:card":"summary_large_image","twitter:site":"@ahostingdotnet","twitter:title":"Open Registration With Privileged Default Role | AHosting","twitter:description":"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.","twitter:creator":"@ahostingdotnet","twitter:image":"https:\/\/www.ahosting.net\/blog\/wp-content\/uploads\/2026\/10\/open-registration-with-privileged-default-role-ahosting.jpg"},"aioseo_meta_data":{"post_id":"1450","title":"Open Registration With Privileged Default Role | AHosting","description":"Open registration with privileged default role means any sign-up becomes an Editor or Administrator. Why Settings cannot set it, and how to fix it fast.","keywords":null,"keyphrases":{"focus":{"keyphrase":"open registration with privileged default role","score":0,"analysis":[]},"additional":[]},"primary_term":null,"canonical_url":null,"og_title":null,"og_description":null,"og_object_type":"default","og_image_type":"default","og_image_url":null,"og_image_width":null,"og_image_height":null,"og_image_custom_url":null,"og_image_custom_fields":null,"og_video":"","og_custom_url":null,"og_article_section":null,"og_article_tags":null,"twitter_use_og":false,"twitter_card":"default","twitter_image_type":"default","twitter_image_url":null,"twitter_image_custom_url":null,"twitter_image_custom_fields":null,"twitter_title":null,"twitter_description":null,"schema":{"blockGraphs":[],"customGraphs":[],"default":{"data":{"Article":[],"Course":[],"Dataset":[],"FAQPage":[],"Movie":[],"Person":[],"Product":[],"ProductReview":[],"Car":[],"Recipe":[],"Service":[],"SoftwareApplication":[],"WebPage":[]},"graphName":"Article","isEnabled":true},"graphs":[]},"schema_type":"default","schema_type_options":null,"pillar_content":false,"robots_default":true,"robots_noindex":false,"robots_noarchive":false,"robots_nosnippet":false,"robots_nofollow":false,"robots_noimageindex":false,"robots_noodp":false,"robots_notranslate":false,"robots_max_snippet":"-1","robots_max_videopreview":"-1","robots_max_imagepreview":"large","priority":null,"frequency":"default","local_seo":null,"breadcrumb_settings":null,"limit_modified_date":false,"ai":{"faqs":[],"keyPoints":[],"schemas":[],"titles":[],"descriptions":[],"socialPosts":{"email":{"subject":"","preview":"","content":""},"linkedin":[],"twitter":[],"facebook":[],"instagram":[]}},"created":"2026-10-16 13:41:15","updated":"2026-10-19 22:19:57","seo_analyzer_scan_date":null,"focus_keyword":"open registration with privileged default role","additional_keywords":null,"truseo_locale":null},"aioseo_breadcrumb":"<div class=\"aioseo-breadcrumbs\"><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/\" title=\"Home\">Home<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\t<a href=\"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/\" title=\"WordPress\">WordPress<\/a>\n\t\t<\/span><span class=\"aioseo-breadcrumb-separator\">\u00bb<\/span><span class=\"aioseo-breadcrumb\">\n\t\t\tOpen Registration With Privileged Default Role? What Site Health Is Telling You\n\t\t<\/span><\/div>","aioseo_breadcrumb_json":[{"label":"Home","link":"https:\/\/www.ahosting.net\/blog\/"},{"label":"WordPress","link":"https:\/\/www.ahosting.net\/blog\/category\/wordpress\/"},{"label":"Open Registration With Privileged Default Role? What Site Health Is Telling You","link":"https:\/\/www.ahosting.net\/blog\/open-registration-with-privileged-default-role\/"}],"_links":{"self":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1450","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/comments?post=1450"}],"version-history":[{"count":2,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1450\/revisions"}],"predecessor-version":[{"id":1463,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/posts\/1450\/revisions\/1463"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media\/1451"}],"wp:attachment":[{"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/media?parent=1450"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/categories?post=1450"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ahosting.net\/blog\/wp-json\/wp\/v2\/tags?post=1450"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}