Introduction #

In this and other guides, the following definitions are used, Users are people who have login access to the WordPress Dashboard, with assigned Roles, and are different to Contacts, who typically lead interest groups, organise meetings and other events, and don’t have login rights, but have details entered into the system. The Administrator is the person appointed by a u3a committee to manage and maintain the website specific to an individual u3a. The System Administrator is a member of the SiteWorks team who is responsible for the complete SiteWorks system including maintenance and hosting.

WordPress technically has no limitations as to the number of Administrators, Editors and Authors that can be added to a Website. While this and other documentation refers to an Administrator, it is strongly recommended that a u3a has more than one Administrator to ensure resilience in case of illness, holiday, etc. However, as the Administrator can change all the site features, it is recommended that the number of Administrators is tightly controlled by a u3a committee.

Any Administrator can allow other members of their u3a, to edit or publish pages and posts, by adding them as either an Editor or Administrator. For example, a group leader can add material to their group pages, without sending it to the administrator for editing and publication. This is achieved by adding individuals as Users with the role of Editor.

It should be noted that, in practice, there will be some overlap between the activities of users and contacts, but they are to be considered separate from the Administrator’s point of view.

This guide discusses the rights available to users, and how the local SiteWorks Administrator can add additional users to the system or remove those who may have stepped down.

It is important to note that a User may be able to view a range of information held by the u3a, including contact details. Hence, any prospective User, in particular Administrators and Editors, should be fully aware of the u3a’s data protection policy and GDPR.

Summary of User Roles and Access Right #

WordPress has five default user roles:

• Administrator: Create, edit, publish, and delete any content, manage plugins and themes, edit code and delete other user accounts.
• Editor: Create, edit, delete, and publish pages and posts, including those belonging to other users.
• Author: Create, edit, delete, and publish their posts (and upload media files), subject to allocation of permission by an Administrator.
• Contributor: Able to read all posts, as well as deleting and editing their posts. They are not permitted to publish posts or upload media files.
• Subscriber: They can only read posts, as well as manage their profiles.

In SiteWorks the Contributor and Subscriber roles are not available, while they can be set, the users have no access to any feature other than their profiles. In addition, an Author’s access rights have been tailored to the specific requirements found in a specific u3a.

In SiteWorks the access to options and tools is tightly controlled, Table 1 shows the broad allocation of privileges between the three Roles. It can be seen that Editors and Authors only have access to the content provision (posts etc), all site configuration is undertaken solely by Administrators. Table 2 details the restrictions placed on users, particularly those identified as Authors.

It should be noted that an Author can only edit pages, posts etc, relating to content allocated to them by the Administrator. If a group is allocated to a specific Author, that user can only edit and publish material directly related to that Group (e.g. the Group Page(s), or Group Event(s).

Overview of Dashboard Rights #

As discussed in the Dashboard user guide, access to configuration options and tools is dependent on the Role as shown below:

Dashboard Option	Summary of all Available Options	Role
Posts	Create, edit, publish and delete posts	A, E, AU†
Media	Allows configuration of the site and several plugins	A, E, AU†
Pages	Create, edit, publish and delete pages	A, E
u3a Groups	Create, edit and delete groups	A, E, AU†
u3a Events	Create, edit, publish and delete events	A, E, AU†
u3a Venues	Add, edit and delete venues	A, E
u3a Contacts	Add, edit and delete contacts	A, E
u3a Notices	Create, edit, publish and delete notices	A, E
u3a Settings	Managing the options relating to u3a groups, events and venues.	A
Appearance	Managing the site appearance under the u3a theme	A
Plugins	Manage plugins	A
Users	Add, edit, and delete users	A
Tools	Tools to manage site data	A
Analytics	Generates a wide range of statistics regarding site usage	A
Settings	Allows configuration of the site and a number of plugins	A
Loginizer Security	Configure the security plugin.	A

In addition, all users have access to their Profile, to change passwords, and several other options, including contact information, first and last names,

Content Management Rights #

The following table summarises the ability of users to manage content on the website:

Feature	Administrator	Editor	Author
Posts	V, C, D, E, P	V, C, D, E, P	V, C, d, e, P
Post Categories	V, C, D, E, P	V, C, D, E, P	V
Media†	V, U, D	V, U, d	V, d, U
Pages	V, C, D, E, P	V, C, D, E, P	V
u3a Groups	V, C, D, E	V, C, D, E	V, e, d, P
u3a Events	V, C, D, E	V, C, D, E	V, c, d, e, P
u3a Venues	V, C, D, E	V, C, D, E	V
u3a Contacts	V, C, D, E	V, C, D, E	V‡
u3a Notices	V, C, D, E, P	V, C, D, E, P	V

c	Create content of this type, subject to the allocation of the required permission(s) by the Administrator.
C	Unrestricted creation of content of this type.
d	Deletion of contents of this type, subject to the allocation of the required permission(s) by the Administrator, or ownership.
D	Unrestricted deletion of content of this type.
e	Edit content of this type, subject to the allocation of the required permission(s) by the Administrator, or ownership.
E	Unrestricted editing of content of this type.
P	Ability to publish content.
U	Upload media of any type.
V	View all website content of this type.

The Users Menu #

The Users Menu is only visible to those with Administrator access rights and is located on the Dashboard, as shown below.

The first option from this menu will display all current users, allowing the editing of their information, the second item allows new users to be added, and the third option allows the current user’s profile to be changed. Each option will be described below.

Adding a New User #

When this option is selected, the new user’s details can be added as required:

The only required information for a user is a username and an email address, this being the minimum required for a new user to log into the site. It is recommended that the u3a adopt a standard format for user names. It is strongly recommended that:

• The username should be not less than ten characters in length, and include a mixture of upper and lower case letters and numbers.
• No reference is made to (i) the u3a in general, (ii) the u3a’s name, and (iii) the name and position of the post holder.

It is important to note that, once set, the user name can not be changed.

A password for the initial logon needs to be generated for the new user, this should be eight (but preferably twelve) characters or more long, with at least one upper and lower case letter, a number and a punctuation mark. If the password does not meet this criteria, adding a new user will fail, and an error message is displayed

Although there is a tick-box displayed to confirm a weak password, the u3a configuration plugin does not permit the creation of a user with any password that does not meet the requirements defined above.

Further advice on password security can be found in the password management user guide and information provided by the UK National Cyber Security Centre.

Important: remove the tick from the box labelled Send User Notification. Email sent using this option may be rejected by the new user’s email account as spam or phishing emails, are often not delivered successfully, and may impact the reputation of the server, as discussed here. If the u3a uses Beacon or a similar system, this route is preferred, as it will create a record in an audit log.

It should be noted that any new user is assigned the Author role by default unless changed by the Administrator., this being the most restrictive available in SiteWorks.

On completion, select Add New User.

When the Administrator sends a new user their initial login credentials, they MUST be instructed to immediately change their password via their user profile.

Managing Users #

On selecting All Users, a list of all the users, is provided, showing their email address, role and the number of posts they have created.

To undertake a change, the user is selected by checking the box on the left to allow the User’s profile to be viewed, edited or have their role changed.

Any User may be deleted, although one active Administrator must remain for the site to be correctly maintained. When the site is set up, several “administrators ” are included to allow the test and migration team to support the individual web manager during the initial rollout of the website.

There is an additional function available from this screen, in particular, the Administrator may send a Password Reset email to a user who has forgotten their password. However, it is important to note that such emails may be rejected by the user’s email account and result in reputational issues, as these emails can be interpreted as spam or phishing. It is recommended that any new password must be sent using an email. If the u3a uses Beacon or similar, this route is preferred as the email will be recorded in the audit log.

User Profile #

The profile of a user provides a summary of all the information held for that person, i.e., Login Username, First Name, Last Name, Email, Login Password and Role. As with all software of this type, WordPress has several options, some of which do not apply to u3a users. A user can change all the information except the username and role, however, it is recommended to remain with the default settings. In summary, the available sections are:

• Personal Options. Sets several editing and display options.
• Name. Gives the username, first and last name and nickname of the user. When a post includes the author’s name, the Display name Publicly as needs to be set, options include:
  • Username
  • First name, Last Name, First and Last name, Last and First Name
  • Nickname – this is always required, the default being the username.
• Contact info. This records the email that the user provided when they became a user. This can differ from the email recorded in the contact section (if the person is both a user and a contact). If a change is required, for example, a personal email account is changed, any changes should be undertaken in consultation with the site’s Web Manager, to ensure an audit trail is maintained. If a user has a personal website this information can be entered.
• About the user. This allows individual users to set up a biography and image. It is strongly recommended that this is not undertaken as this information may be visible on external sites. In addition, the profile picture can be added, however, this requires setting up a Gravatar account, which is not recommended.
• Account Management:
  • Allows the setting of a new password.
  • Provides the capability to logout for a session on another device, e.g. a smartphone or another computer. Once selected, the user will only be logged in to their current session.
• Application Passwords. Not required for SiteWorks users.

Assigning Pages or Groups to a Specific Author. #

An Author cannot create a new page or group; the Administrator may wish to allocate an existing or newly created page or group to a specific Author, for example to a group leader when a group is created. Once a group is assigned to an Author they can edit the Group Page, and create and publish posts and events related to the group.

Select Pages ⇒ All Pages or Groups ⇒ All Groups from the Dashboard, then select Quick Edit when hovering over the name. Then select the Author to be assigned from the pull-down menu, and then Update. The example below is for a Group:

Deleting a User #

When deleting a user, the Web Site Administrator needs to note that any content created by that user is also deleted, unless the administrator assigns that content to another user.

When the Administrator select delete from the options given when hovering over the user’s name, the following options are displayed:

• Delete all content: this option will delete all the content generated by the user permanently (i.e. there is no recover from bin option). It is advised that this option is not selected.
• Attribute all contents to: this option will allow the administrator to assign all the content created by the user to be reassigned to any other user in the system. For example, if a group leader changes, all the content created by the outgoing group leader can easily be assigned to the new group leader, as long as that person has been added as a user before the original user is deleted. The user who will be taking over the content can be selected from the pulldown menu.

Once an option is selected, the Comfirm Deletion option can be selected.