Users & Roles

Most councils have more than one person who helps run the website. The Users & Access area lets you create accounts for colleagues and decide what each of them can do, using roles.

Who can manage users

Clerks and super administrators can both create, edit and delete user accounts. A clerk can't see, change or delete a super administrator's account, and can't make anyone a super administrator. Only super administrators see Roles, the screen where the roles themselves are set up.

▶ Video Users and roles · 1 min

The roles explained

A role is a bundle of permissions. Rather than ticking individual boxes for each person, you give them a role and they get everything that role can do. The admin panel shows roles by their system names, given in the second column.

Role	Shown as	What it can do
Super administrator	`super_admin`	Everything, including the Roles screen, Advanced settings, migration runs and deleting records permanently. Grant it sparingly.
Clerk	`parish_council_clerk`	Day-to-day running of the website: all content, users (except super administrators), access rules and most settings. Can view payments and the audit log, and restore deleted records, but can't delete anything permanently.
Blog author	`blog_author`	Writes and manages their own blogs and posts, and moderates comments on them. Sees nothing else.
Page administrator	`page_administrator`	Edits only the pages an access rule gives them, and can upload and edit files in the Media Library. Can't create or delete pages, or delete files.
Resident	`end_user`	For people who sign in to the public website but not the admin panel, such as councillors reading private pages. Residents who register on the website get it automatically; registration is only open when Resident Issues is switched on.

Seeing panel_user as well?

Some older websites also list a role called panel_user. It's left over from an earlier version and does nothing, so don't give it to anyone.

Adding a new admin user

Go to Users & Access > Users in the sidebar.
Select New user.
Enter their Name and Email. They sign in with this email address.
Set a starting Password and turn on Force Password Reset, so they must choose their own password when they first sign in.
Under Roles, choose the role that matches what they need to do.
Select Create.

Phone and Avatar are optional. Give them the email address and starting password yourself; the website doesn't send a welcome email.

The Create User form as a clerk sees it, with the Roles list open showing blog_author, end_user, page_administrator and parish_council_clerk — Creating a user as a clerk. Super administrator isn't offered, because only a super administrator can give that role.

Tip: least privilege

Give each person the lowest-powered role that still lets them do their job. A blog contributor rarely needs full clerk access, and almost no one needs to be a super administrator. This keeps your site safer.

Editing and removing users

To edit a user: open Users & Access > Users, select Edit on their row, make your changes, then select Save changes. Change their role here when their responsibilities change.

To remove a user: select Delete on their row, then confirm. They can no longer sign in. Like other records, a deleted user can be brought back; see Deleted something by mistake?

To stop someone signing in without deleting them: select Edit on their row, switch off Is active, then select Save changes. They're signed out at once, from the admin panel, the website and the mobile app, and see a message asking them to contact the council. Their account and everything they wrote are kept. Switch it back on to let them in again.

Built-in safeguards

You can't delete or switch off your own account, and the last remaining super administrator can't be deleted. These stop anyone locking everyone out. When a councillor or member of staff leaves, delete their account promptly to keep your site secure.

Access rules: which pages a page administrator can edit

A page administrator starts with no pages at all. An access rule gives one or more page administrators the right to edit a set of pages. They then see only those pages in Content > Pages.

Go to Users & Access > Access Rules.
Select New access rule.
Enter a Rule Name that says what it's for, such as "Post Office editors". Add Notes if they'll help someone later.
Under Page Administrators, pick the people. Only users with the page administrator role can be chosen.
Under Pages, pick the pages they may edit.
Leave Active on and select Create.

Turning Active off pauses the rule without deleting it. Access rules only control editing in the admin panel. To control who can read a page on the website, use Private Pages.

Two-factor authentication

Two-factor authentication (2FA) adds a six-digit code from a phone app to signing in. It's strongly recommended for everyone who can edit content. Each person sets it up themselves from their own Profile; see Two-factor authentication on The Admin Panel page for the steps and recovery codes.