0.4Discovering the dashboard (admin)
The essentials in 30 seconds
- /wp-admin is the control centre: the left-hand menu organises Posts, Pages, Media, Appearance, Plugins, Users, Settings.
- Front office = the site as visitors see it; back office = the administration. The top bar links the two.
- The roles (Administrator, Editor, Author, Contributor, Subscriber) determine who can do what: apply least privilege.
Running mini-case — Samir trains Hassan
The Atelier Bahja site is installed. Hassan wants to publish his posts and photos himself, but Samir does not want to give him administrator rights: a wrong move could break the site. This section serves as a guided tour of the administration and as training material for choosing Hassan's exact role.
Sequel to case 0.3 — we move from installation to getting to grips with the tool.
1. The map of the administration
You access the administration by adding /wp-admin to the site address. On the left, the menu is the table of contents for your work: Posts and Pages for content, Media for files, Appearance for the theme and menus, Plugins for features, Settings for configuration. At the top, the toolbar lets you switch to the public site and quickly edit a page.
The front office is what the visitor sees; the back office is reserved for authorised people. Samir shows Hassan both screens and the “View site” / return to admin gesture, which he will use constantly. He also hides unnecessary dashboard widgets for a clearer interface.
2. User roles
WordPress distinguishes permissions by role. The Administrator can do everything, including changing settings and breaking the site. The Editor manages everyone's content, the Author publishes their own content, the Contributor proposes drafts without publishing, the Subscriber can only read. The principle of least privilege means granting the minimum necessary.
For Hassan, an Author or Editor role is enough to publish collections and advice. Samir keeps the administrator role for technical matters. This separation protects the site and clarifies responsibilities: the client publishes, the provider maintains.
🔎 Concrete example — Giving Hassan the right role (Samir case)
Need: publish posts, photos and collections, without touching settings.
Administrator role: too broad (risk of breaking the site).
Editor role: publishes and manages all content.
Author role: publishes their own content.
→ Choice: Editor, with a short training in the block editor.Result: Hassan autonomous, Samir keeps the technical side.
Lesson: roles are a security tool, not a formality.
Section vocabulary
- Dashboard
- Administration interface (/wp-admin) where you create content and configure the site.
Simple example: Hassan logs in to /wp-admin to write a post.
What it is not: confusing the dashboard with the public site.
Reflex: /wp-admin = behind the scenes.
- Front office / back office
- Front: the public site; back: the administration reserved for authorised users.
Simple example: the top bar switches from one to the other.
What it is not: believing that changing the back office immediately changes everything for everyone without publishing.
Reflex: two screens, two uses.
- Toolbar
- The black bar displayed when logged in: quick navigation and edits.
Simple example: Samir clicks “View site” to check the rendering.
What it is not: looking for the administration link in the public site menu.
Reflex: logged in = toolbar visible.
- User role
- Level of permissions assigned to an account: administrator, editor, author, contributor, subscriber.
Simple example: Hassan receives the Editor role.
What it is not: giving Administrator to every account.
Reflex: least privilege by default.
- Least privilege
- Security principle: grant only the permissions strictly necessary.
Simple example: a writer does not need the site settings.
What it is not: allowing everything “to avoid blockages”.
Reflex: fewer permissions = less risk.
In practice — Exploring the administration
- Log in to /wp-admin and browse each menu: guess its function before clicking.
- Switch to “View site” then come back: locate the toolbar.
- Open Users → Add and observe the available roles without creating an account.
- Hide two unnecessary dashboard widgets via “Screen Options”.
Ready-to-say script — training the client (30s)
“Here is your administration. On the left, everything is organised: posts, pages, photos. You will have the editor role: you can publish without risking breaking the site. For technical settings, you go through me.”
Show the screen during the explanation, not just say it.
Copy-paste template — project roles
PERSON: _______________ ROLE: _______________
CAN PUBLISH: yes / no
CAN CHANGE SETTINGS: yes / no
TRAINING PLANNED (date): _______________
TECHNICAL CONTACT: _______________Autonomous client
Editor role + short training: they manage all content.
Editorial team
Authors to write, Editor to approve before publication.
Provider only
The client remains a Subscriber or has no account; they approve by email.
Shop
A Shop Manager role dedicated to orders, separate from the administrator.
✓ Best practices
- Apply least privilege from the first account.
- Train the client on their exact role, not the whole admin.
- Keep a backup administrator for technical matters.
✗ Common pitfalls
- Giving Administrator for convenience.
- Confusing the public site with the administration.
- Multiplying administrator accounts unnecessarily.
Key takeaways
- /wp-admin is the site's control centre.
- Front office = public site; back office = administration.
- Roles limit permissions; least privilege.
- Hassan publishes as Editor without accessing settings.
48h Challenge — apply tomorrow
On your local WordPress, create a fictional Editor account and log in with it: note three things it can do and three it cannot. This will help you review roles. 15 minutes.
- I can find my way around /wp-admin.
- I distinguish front office and back office.
- I choose a suitable role according to least privilege.
Frequently asked questions
How do I access the administration?
Add /wp-admin (or /wp-login.php) to the site address: monsite.ma/wp-admin. Log in with the username created at installation. Add the page to your bookmarks.
Should I give the Administrator role to my collaborators?
No. A writer receives Author or Editor; a proofreader, Contributor. The administrator can change everything, including breaking the site: reserve it for the person who handles technical matters.
What happens if I hide a dashboard widget?
The change is personal: it only modifies your display. Other users keep theirs. It is useful for decluttering the interface without affecting the team.
Samir must create the administrator account for Hassan's site. Which security reflex should he apply from installation?