When adding a new user role with
add_role(), are there any capabilities attributed to the role (or allowed by the role) by default?
It is possible to create a role without defining any capabilities. There will simply be no capabilities set for this role in the database. However, you can explicitly deny capabilities by setting them to false upon creating the role.
(array) (Optional) List of capabilities, e.g. array( 'edit_posts' => true, 'delete_posts' => false );
I have seen examples of this, but I am left wondering why this would ever be necessary unless WordPress assumes that a newly created role has certain capabilities until otherwise excluded.
For example, are all roles assumed to have the
read capability unless the capability is explicitly excluded? I can use
get_role( $new_role )->capabilities; to get a list of capabilities which are explicitly set, but this does not answer my question about how WordPress handles new roles. If no capabilities are explicitly set for a new role then this will return empty.
Must I exclude all capabilities I don't not want a role to have or does WordPress presume all capabilities to be false until they are set as true?
Edit: This question was inspired by an example on the developer site which sets a capability to false when a role is created. I can't see why this would be necessary.
$result = add_role( 'guest_author', __( 'Guest Author', 'testdomain' ), array( 'read' => true, // true allows this capability 'edit_posts' => true, 'delete_posts' => false, // Use false to explicitly deny ) );