Skip to documentation content

Hotel Setup

Assign roles and staff access

Give hotel staff the least WordPress access required for booking operations without sharing an Administrator account.

Assign each staff member a separate WordPress account and the narrowest Hotel Booking role that supports their duties.

Built-in roles

Role Intended access
Hotel Manager All Hotel Booking capabilities, including rooms, bookings, payments, settings, rates, services, reviews and channels.
Receptionist Hotel Booking dashboard plus viewing and managing bookings. No room, payment, rate, service, review, channel or settings management.
Administrator WordPress administration plus all Hotel Booking capabilities. Reserve for site administration, package installation and recovery.

Pro screens also enforce their feature entitlement and the matching Hotel Booking capability. A menu item being hidden is not proof that an account is safe; verify the actions the account can perform.

Assign a role

  1. Open Users → All Users.
  2. Open the staff member’s account.
  3. In Role, choose Receptionist or Hotel Manager.
  4. Select Update User.
  5. Ask the staff member to sign in with their own account.

Do not share an Administrator login between reception staff. Use a password manager and the site’s multi-factor authentication policy where available.

Expected result

A Receptionist can open the Hotel Booking dashboard and bookings list and can perform supported booking operations. The account cannot manage rooms, payments, rates, services, reviews, channels or Hotel Booking settings. A Hotel Manager can manage the complete Hotel Booking administration area but should not need general WordPress plugin or theme installation privileges.

Verify least privilege

  1. Sign in with a dedicated test account assigned the chosen role.
  2. Confirm the required Hotel Booking screens and actions are available.
  3. Attempt to open one out-of-scope screen by its saved administration link.
  4. Confirm WordPress denies access, not only hides the menu item.
  5. Sign out and record the approved role assignment.

If a user keeps obsolete access after an update, remove and reassign the role, then repeat the direct-link checks. Do not grant Administrator merely to work around a missing Hotel Booking capability; escalate the exact denied action for review.

Was this article helpful?

Your feedback helps us improve the documentation.

Configure hotel profile, currency and timezone Set the hotel identity, base currency and WordPress timezone before creating prices or accepting bookings. Read article → Create room types Create a sellable room type with a unique code, capacity, base nightly price, inventory quantity and… Read article → Set room capacity and inventory Model adults, children and physical room quantity so availability protects the hotel's real inventory for every… Read article →