How to Manage Staff, Permissions, and Settings on Your Restaurant Website

10Web lets you create staff accounts, assign roles and permissions, manage account security, and configure advanced settings for your restaurant website.

Staff access is managed through 10Web User Management, which works together with the Restaurant Plugin. You can control which features each team member can access, organize staff into groups, and review account activity.

This guide explains how to manage staff accounts, create custom roles, configure User Management settings, and handle restaurant data and system configuration.

If you haven't created your restaurant website yet, start with How to Create and Manage a Restaurant Website With 10Web.

Access your restaurant's WordPress dashboard

To manage staff accounts, permissions, and restaurant settings, first open your website's WordPress Admin Dashboard.

You can access it in two ways:

• From the 10Web dashboard, click the W icon on your website thumbnail.
• From the 10Web Editor, click the W icon next to the Publish/Save button.

Inside WordPress, use User Management in the left sidebar for accounts, roles, groups, and account settings, or Restaurant for restaurant-specific configuration, data, and system tools.

Step 1. Manage restaurant staff, roles, and permissions

10Web User Management lets you create staff accounts, assign roles, organize teams, and control which restaurant features each person can access.

For example, you may want restaurant managers to configure reservations and menus, while hosts can only manage bookings, guests, and the waitlist.

The User Management section includes five main areas: Users, Roles, Groups, Activity, and Settings.

Create staff accounts

Navigate to User Management → Users.

The Users screen displays all registered accounts, including their names, email addresses, roles, account status, joined date, and last sign-in.

You can filter accounts by All, Verified, Unverified, or Banned, search for users, and export account information.

To add a staff member:

1. Click Add New User.
2. Enter their Email address.
3. Enter their First name and Last name.
4. Under Role, select the appropriate restaurant role.
5. Optionally, enter a Password.
6. Click Create account.

If you leave the password field empty, the staff member receives an email with a link to set their own password.

Accounts created manually are considered verified.

Restaurant roles

Navigate to User Management → Roles to review available roles.

The restaurant includes three important roles:

• Owner: Has full access to restaurant settings, user management, bookings, payments, and other administrative functions.
• Manager: Can manage restaurant operations according to the permissions assigned to the role.
• Host: Has limited operational access, primarily for handling reservations, waitlists, and guest-related tasks.

The Roles screen displays each role's name, internal identifier, inherited role, number of assigned users, permissions, and type.

Other WordPress or plugin roles, such as Editor, Author, Subscriber, and Customer, will also appear.

Create a custom role

You can create custom roles when the default roles do not match your team's responsibilities.

For example, a restaurant may need a Front Desk role that can manage reservations but cannot change menu prices or financial settings.

To configure a role manually:

1. Navigate to User Management → Roles.
2. Click Add New Role.
3. Enter a Name and optionally a Slug.
4. Under Start from a copy of, select an existing role whose permissions you want to use as a starting point.
5. Under Inherits from, optionally select a role whose permissions the new role should inherit.
6. Select the required capabilities under Permissions.
7. Click Create role.

The role editor provides permissions across several categories, including Account, Content, Users and site, and Restaurant.

You can also request this configuration through AI.

Example prompt:

Create a Front Desk role based on Host. Allow staff to view and manage bookings, add guests to the waitlist, mark guests as seated, and redeem gift cards. Do not allow them to edit menu prices, change restaurant settings, refund deposits, or view financial reports.

Configure restaurant permissions

Under the Restaurant permissions section, you can control access to specific features and actions.

Available permissions include:

• Menus: Edit sections, items, menus, translations, and prices.
• Tables: Manage seating areas, tables, joined tables, and temporary closures.
• Booking settings: Manage restaurant locations, opening hours, closures, and booking rules.
• Bookings: View reservations, create bookings, manage the waitlist, override availability, change bookings, cancel bookings, delete bookings, and mark no-shows.
• Deposits and fees: Refund deposits, approve charges, and configure deposit rules.
• Gift cards: Sell, redeem, correct, and refund gift cards.
• Clients: View customer records, access saved allergies, and manage customer exports, imports, merges, and deletions.
• Reports: View restaurant reports and dashboard statistics.
• Restaurant settings: Manage switches, messages, email settings, languages, tools, and system configuration.

You can assign permissions individually instead of giving staff full access to an entire section.

For example, a host can be allowed to view and change reservations without receiving permission to delete them.

Some privileged capabilities are restricted to administrative roles and cannot be granted to visitor-facing roles, even if selected in the role editor.

For details about the restaurant features controlled by these permissions, see How to Set Up and Manage Table Reservations on Your Restaurant Website and How to Create and Manage the Restaurant Menu on Your Website.

Manage user profiles

To review a staff member's account:

1. Navigate to User Management → Users.
2. Click the user's name.
3. Review or update their profile information.

The user profile contains:

• Details: Name, display name, email, website, biography, and profile picture.
• Account: Role, account status, registration date, password status, and password reset options.
• Devices: Devices and sessions associated with the account, including sign-in and last-seen information.
• Groups: Groups to which the user belongs.
• Recent activity: Recorded account actions and activity.

You can also use Send password reset to send the user a password reset link.

Under Danger zone, authorized administrators can use End every session to sign the user out of all active sessions.

Organize staff into groups

Groups let you organize users into named collections, such as teams or departments.

Navigate to User Management → Groups.

The Groups screen shows existing groups, their types, owners, membership counts, and creation dates.

You can filter and export group information.

To create a group:

1. Click Add New Group.
2. Enter a Name, such as Downtown Restaurant Team.
3. Optionally, enter a Slug. If left empty, it is generated from the name.
4. Under Type, enter a group category, such as team.
5. Under Owner, optionally enter the email, username, or ID of the person responsible for the group.
6. Click Create group.

The specified owner becomes a manager of the group.

Example AI prompt:

Create a group called Downtown Restaurant Team, set its type to team, and assign our downtown manager as the group owner.

Review staff activity

Navigate to User Management → Activity.

The Activity section records security and account-related events, including sign-ins, failed attempts, lockouts, account changes, role changes, and settings updates.

The activity table includes information such as:

• When the event happened
• Event type
• Related account
• Who performed the action
• Source address
• Source of the action
• Additional details

You can search, filter, and export activity records.

This helps restaurant owners investigate account changes and monitor staff access.

Step 2. Configure User Management settings

User Management provides additional controls for account registration, security, email notifications, and user experience.

Navigate to User Management → Settings.

The settings are organized into seven tabs: Sign-up, Sign-in & limits, Passwords, Emails, Screens & redirects, Features, and Advanced.

Configure account registration

The Sign-up tab controls how users create accounts.

Available options include:

• Self-service sign-up: Allow visitors to create their own accounts. If disabled, accounts must be created by an administrator.
• Default role: Choose the role assigned to new accounts after verification.
• Email verification: Require users to verify their email address before receiving their default role.
• Usernames: Configure whether people sign in using email addresses or usernames.
• Terms page: Select the page users must accept during registration.
• Privacy page: Select the privacy policy page users must accept during registration.

For a restaurant website, the default role should generally be a customer-facing role rather than a staff or administrative role.

Example AI prompt:

Allow customers to create accounts using their email addresses, require email verification, and set Member as the default role. Require users to accept our Terms and Privacy Policy during registration.

Configure sign-in limits and security

The Sign-in & limits tab helps protect your website from repeated login attempts and automated requests.

You can configure:

• Stay signed in for (days): How long a user remains signed in when selecting the stay-signed-in option.
• Failed attempts before a lockout: Number of unsuccessful login attempts allowed.
• Lockout length (minutes): Duration of the initial lockout.
• Repeat lockout length (minutes): Duration of subsequent lockouts.
• Sign-in attempts per minute, per address: Maximum login attempts allowed from one address.
• Sign-ups per minute, per address: Limit on account registrations.
• Email-sending requests per minute, per address: Rate limit for requests such as password resets and verification emails.
• Email-sending requests per hour, per account: Limit on email requests associated with one account.

The default configuration shown includes a 30-day stay-signed-in period, 10 failed attempts before lockout, a 15-minute initial lockout, and a 60-minute repeat lockout.

Configure password requirements

The Passwords tab lets you define password requirements for registered users.

You can configure:

• Minimum length: The minimum number of characters required, which is 8 by default.
• Require mixed characters: Optionally require uppercase and lowercase letters and a number.

Click Save Changes after updating the settings.

Configure account emails

The Emails tab controls the appearance and wording of account-related emails.

You can configure:

• Sender name: The name displayed as the email sender.
• Sender address: The email address used to send notifications.
• Colour: The accent colour used in emails.
• Welcome email: Whether to send a message when an account becomes active.
• New sign-in email: Whether to notify users when their account is accessed from a new device.
• Tell me when someone signs up: Whether to notify the site administrator about new registrations.
• Footer text: Optional text added to the bottom of account emails.

The Wording section also lets you customize messages for email verification, password creation and resets, email address changes, welcome emails, and other account events.

You can use placeholders such as {site_name}, {name}, and {email} in supported messages.

You can also customize the emails with AI.

Example AI prompt:

Change our account welcome email to use a friendly restaurant tone, thank customers for joining Bella Italia, and encourage them to manage their reservations through their account.

Configure account pages and redirects

The Screens & redirects tab defines which website pages are used for account-related actions.

You can configure pages for sign-in, account management, email verification, password reset, new email confirmation, and password creation.

You can also set where users are redirected after signing in, based on their role.

For example, you can direct customers to their account page while sending restaurant managers and hosts to an appropriate dashboard.

Example AI prompt:

Redirect customers to /my-account after signing in and send restaurant managers and hosts to the restaurant dashboard.

This tab also includes settings for allowed external sign-in redirect hosts.

Enable or disable account features

The Features tab lets you control available User Management functionality.

Currently available switches include:

• Activity log
• Custom sign-up fields
• Sign-up approval
• Social sign-in

Turning off an available feature disables its functionality without deleting the data it previously created.

Configure advanced settings

The Advanced tab under User Management → Settings lets you configure additional security, account data retention, and WordPress access settings.

Available options include:

• Client address header: Specify the header used to identify visitors' IP addresses when your website is behind a proxy, such as CF-Connecting-IP. Leave empty to use the connecting address.
• Narrow the core users API: Restrict users without the appropriate permissions to viewing only their own information through the WordPress REST API.
• WordPress toolbar: Choose which users can see the WordPress toolbar on the front end of your website. You can limit it to owners and administrators or allow additional roles.
• Keep activity for (months): Set how long user activity records are retained. The default is 12 months.
• Keep the email log for (days): Define how long account-related email logs are stored. The default is 90 days.
• Delete never-verified accounts after (days): Automatically delete accounts that have never verified their email address or signed in after the specified period. The default is 90 days.

Danger zone

The Delete all user management data on uninstall option controls whether the plugin's account records, tokens, activity history, and email logs are deleted when User Management is uninstalled. WordPress user accounts themselves are preserved.

Step 3. Manage restaurant data and privacy

The Restaurant Plugin provides tools for exporting information, processing personal data requests, and reviewing data retention rules.

Navigate to Restaurant → Tools → Data and privacy.

Export restaurant data

Under Export the Restaurant's Data, click Download Data.

The export creates a JSON file containing restaurant data, including locations, menus, tables, bookings, clients, gift cards, messages, and activity logs.

Sensitive keyed-link secrets are excluded.

Handle personal data deletion requests

The Start an Erasure section lets you initiate a request to delete a customer's personal information.

To start:

1. Enter the person's email address under Their email.
2. Click Send Erasure Request.
3. The customer receives an email asking them to confirm the request.
4. Once confirmed, the request is processed through the WordPress personal data tools.

You can also use Open Erase Personal Data and Open Export Personal Data links to access WordPress's corresponding tools to complete the request. 

If a customer's personal data is deleted, identifying details are removed from their restaurant record.

Historical bookings may remain under an anonymized customer label, while previously purchased gift cards continue to function.

Understand data retention

The How Long Things Are Kept section displays retention periods for different types of restaurant data:

Step 4. Manage additional restaurant settings

The Restaurant Plugin includes tools for transferring settings, checking integrations, and monitoring system health.

Export and import restaurant settings

If you manage multiple restaurant websites, you can easily transfer settings from one website to another by navigating to Restaurant → Settings → Transfer in your WordPress dashboard.

• Export settings: Click Download Settings to export configuration as a JSON file.
• Import settings: Paste previously exported JSON configuration and click Import Settings.

SMTP passwords are excluded from the export.

The Danger zone includes Reset All Settings, which restores restaurant-wide settings to their defaults without removing locations, tables, menus, bookings, or clients.

Resetting settings can affect your restaurant's active configuration. Review the implications before proceeding.

Review connected services

Navigate to Restaurant → Settings → Connections to check the status of services and integrations used by your restaurant website.

The Connections tab displays each integration, its connection status, and the functionality it provides:

• Accounts and roles: Manages guest accounts, sign-in, staff access, and Manager and Host roles with their permissions.
• Payments: Handles reservation deposits, saved cards through Stripe, fees, and online gift card payments.
• Text, WhatsApp and push: Additional communication channels for restaurant notifications. These are not available yet; email is currently the only supported channel.
• Listing sites: Integrations with platforms such as Google Business Profile, Apple, Yelp, TripAdvisor, and Facebook. These are not available yet.

Each service displays its current status as Connected or Not available. You can also click the linked service names to access the corresponding integration.

Check restaurant system health

Navigate to Restaurant → Settings → Health to monitor your restaurant website's system status and review recent activity.

The Health tab displays the following information:

• Days of free times cached: Shows the number of days of reservation availability currently cached and when the cache was last built.
• Five-minute job: Displays when the background job last ran. This job automatically closes pending reservations that have run out of time.
• Messages: Shows the status of message tracking. This functionality is not available yet.
• Checks: Displays the current system configuration status and indicates whether any issues need attention.
• Activity log: Records restaurant-related actions, such as booking changes, customer updates, gift card redemptions, and settings changes. Each entry shows when the action occurred, what changed, who performed it, and whether it came from the WordPress dashboard or API.

You can click Rebuild Free Times to refresh cached reservation availability.

The Health section helps you monitor restaurant operations, identify configuration issues, and review changes made by staff or through the API.

What's next?

You can now manage your restaurant's staff accounts, roles, permissions, security settings, and data.

To manage customer records, sell gift cards, and analyze restaurant performance, see How to Manage Restaurant Customers, Gift Cards, and Reports.

For other restaurant features, see:

• How to Create and Manage a Restaurant Website With 10Web — create your restaurant website and configure locations and opening hours.
• How to Create and Manage the Restaurant Menu on Your Website — manage menu items, sections, prices, and dietary information.
• How to Set Up and Manage Table Reservations on Your Restaurant Website — manage seating, bookings, waitlists, deposits, and booking notifications.