Accessing the POS
To control access to the WCPOS functionality, you can utilise WordPress capabilities and user roles. By assigning specific roles to users and configuring their capabilities, you can tailor the access levels for different POS users. The WCPOS plugin integrates with the existing WordPress roles and introduces a specific role for cashiers.
The following table outlines the main user roles in the POS and their respective capabilities:
| Role | Created By | Description |
|---|---|---|
| Administrator | WordPress | The site owner who has all capabilities enabled by default. |
| Shop Manager | WooCommerce | This role is designed for users who need access to the POS and the ability to manage POS settings. Shop Managers may not have permission to install plugins or perform other administrative tasks. |
| Cashier | WCPOS | This role is added by the WCPOS plugin and is intended for users who will primarily use the POS. Cashiers can run the till and, by default, create and edit products and customers — but they don't have access to WP Admin to modify POS settings, install plugins, or create blog posts. You can tighten or loosen any of this per capability (see below). |
As of v1.10, the Cashier role is granted product create and edit capabilities out of the box, so staff can fix a price or add a product without an admin. Deleting products stays opt-in — it is not granted by default. Every product and coupon write is still checked against the user's real WordPress capabilities on the server; a write the server rejects is reverted on the device and the cashier is shown the reason. Adjust any of these grants on the Access screen.
To assign and manage user roles and capabilities, you can navigate to WP Admin > POS > Access, where the capability toggles are grouped by task (products, orders, customers, and so on) to make the effect of each one easier to see.
The Manage POS settings toggle (manage_woocommerce_pos) controls the settings pages under WP Admin > POS and the settings API behind them. The Settings screen inside the POS window is different: it holds per-device preferences such as the printer, barcode scanner, theme and display options, it is stored on that device only, and it is available to every user who can open the POS. Turning off Manage POS settings does not hide it, and nothing a cashier changes there reaches the server.
The POS customer list shows every WordPress user, including staff, because any account can be the customer on an order. Editing is narrower than viewing: a POS user who is not an administrator cannot edit or delete an account that holds staff capabilities, whatever the Manage customers toggle says. Staff means administrators, shop managers, other cashiers, and anyone with an author seat in wp-admin such as editors, authors and contributors (the capabilities manage_options, manage_woocommerce, edit_users and edit_posts). Only administrators can change staff accounts from the POS.
The following table provides an overview of the WordPress capabilities associated with the WCPOS plugin:
| Capability | Description | Example Usage |
|---|---|---|
access_woocommerce_pos | Allows access to the WCPOS interface. | Enabling this option would grant the cashier permission to access and use the POS, allowing them to perform point-of-sale transactions. |
manage_woocommerce_pos | Enables the management of WCPOS settings and configurations. | Enabling this option would give the cashier the ability to modify settings related to the POS, such as payment methods or receipt templates. |
create_users | Allows the cashier to create new WordPress user accounts. | Disabling this option would prevent the cashier from creating new customer accounts in the POS. |
edit_others_shop_orders | Enables editing of shop orders created by other cashiers. | Disabling this option would prevent a cashier from modifying shop orders created by a different cashier in the POS. |
edit_product | Allows the cashier to edit product details. | Disabling this option would prevent the cashier from modifying the details of products available in the POS. |
edit_published_products | Allows the cashier to edit published products. | Disabling this option would prevent the cashier from making changes to products that are already published in the POS. |
edit_shop_orders | Allows the cashier to edit shop orders. | Disabling this option would prevent the cashier from modifying the details of shop orders, such as order status or customer details, in the POS. |
edit_users | Allows the cashier to edit existing user accounts. | Disabling this option would prevent the cashier from modifying the details of customer accounts, such as billing address, in the POS. |
list_users | Allows the cashier to view a list of user accounts. | Disabling this option would prevent the cashier from searching or selecting customers in the POS. |
manage_product_terms | Allows the cashier to manage product categories and tags. | Disabling this option would prevent the cashier from creating, editing, or deleting product categories or tags in the POS. |
publish_shop_orders | Allows the cashier to publish shop orders. | Disabling this option would prevent the cashier from finalizing and processing new shop orders in the POS. |
read_private_products | Allows the cashier to access the details of private products. | Disabling this option would prevent the cashier from viewing the details of private products available in the POS. |
read_private_shop_coupons | Allows the cashier to access the details of private shop coupons. | Disabling this option would prevent the cashier from viewing the details of private shop coupons in the POS. |
read_private_shop_orders | Allows the cashier to access the details of private shop orders. | Disabling this option would prevent the cashier from viewing the details of private shop orders in the POS. |
read | Allows access to the WordPress Admin. | Disbaling this prevents the cashier from access the WordPress Dashboard and user profile page. |
By assigning the appropriate capabilities to each role, you can fine-tune the access and permissions for different users in the POS. This allows you to control who can perform certain actions, view sensitive information, and make changes to your store.
For more detailed information on managing user roles and capabilities in WordPress, you can refer to the WordPress Codex.
What each default role can do, at a glance
With the default capabilities in place, the three roles behave as follows in the POS:
- Administrator — full POS and management access.
- Shop Manager — full POS and management access, except actions that require the ability to install plugins (such as installing or activating POS extensions).
- Cashier — the normal POS selling workflow (browsing products, taking orders, processing payments, printing receipts, managing customers) plus creating and editing products by default (deleting is opt-in), but no access to settings, logs, or store administration.
For the full per-endpoint breakdown — including the Pro plugin endpoints, token-expiry behaviour, and tips for distinguishing capability failures from token failures — see the Role Endpoint Access reference.
A user with more than one role
WordPress lets one account hold several roles, although the profile screen only shows this when a plugin such as Members adds the role checkboxes. WordPress merges the capabilities of every role the account holds, so a second role on its own rarely takes anything away. Role-editor plugins change that. Members ships with Denied capabilities should always overrule granted capabilities switched on, so a capability marked Deny on any of the account's roles wins over a grant from every other role, whatever order the roles are in. An Administrator who is also a Customer inherits every Deny placed on the Customer role.
What you see depends on the WCPOS version. Current WCPOS versions refuse the POS sign-in and name what is missing:
For example, an Administrator-plus-Customer account with the denies above sees:
This account cannot use the POS. Missing capabilities: publish_shop_orders, read_private_products, read_private_shop_orders, list_users. It has the roles Customer, Administrator. A capability denied on one role can override a grant from another, and role-editor plugins such as Members apply that deny first. Remove the extra role or clear the deny in the role editor.
Older versions only checked access_woocommerce_pos at sign-in, which the denies leave intact, so the account signed in and then every screen failed: no products or customers, and orders that would not save. On those versions the POS log at Store health → Logs on the affected device records each refused request with the server's code. woocommerce_rest_cannot_view on products means read_private_products is missing, on customers it means list_users, and woocommerce_rest_cannot_create on an order means publish_shop_orders. The entries are reported as AUTH201.
For the site administrator: either remove the extra role from the account (Users → All Users, then edit the account), or open that role in the role editor and clear the Deny marks on the capabilities listed. The Access screen in WP Admin shows grants only; a Deny placed by a role editor is not visible there. Once the roles are fixed, a user with an existing POS session signs out and back in; a user who was refused at sign-in simply signs in again.