PBJ Access Control Changelog (v2.4.0): A Setup Checklist That Shows Your Gaps

PBJ Access Control gates WordPress pages behind login, blocks WooCommerce for logged-out visitors (with an optional escape hatch for the registration form), customizes the restricted-content message, and adds an admin-approval workflow for new registrations — capturing each signup’s IP address and location so admins can triage from the User Approvals screen or straight from the notification email. Here’s the release history.

Version 2.4.0 — a setup checklist that shows your gaps

• Setup checklist at the top of Settings → Access Control: live status rows (green tick / red triangle) showing how many Pages are currently restricted, whether WooCommerce blocking is on (shown only when WooCommerce is active), whether registration approval is on plus how many users are waiting in the approval queue, and whether the restricted-content message is set — each with a one-line explanation and a button linking straight to where you fix it.
• Numbered “How to use this plugin” walkthrough covering the full workflow: restrict a Page via its meta box, optionally block WooCommerce, customise the visitor message, turn on registration approval, and approve or deny signups (with IP + location) from Users → PBJ User Approvals.
• Every settings field now carries a plain-English “what it does” description — nothing on the Settings tab is left to guessing.

Version 2.3.0 — license keys arrive

A License section was added to PBJ Access Control’s settings. Enter the PBJ license key from your purchase and the plugin unlocks automatic updates straight from pbj.tech, delivered through the normal WordPress updates screen. The plugin is fully functional without a key — a key only gates updates, never features — and one key covers up to 3 sites.

Version 2.2.0

• Built-in User Guide — a new tab on Settings → Access Control covering page restriction, WooCommerce gating, the approvals workflow, verification, troubleshooting, and a quick reference. Also linked from the Plugins list row.

Version 2.1.0

• Security: restricted content no longer readable via the REST API. Restricted pages’ content and excerpt are blanked in /wp-json/wp/v2/pages responses (and oEmbed) for logged-out requests — previously the full content was publicly readable there even though the page itself was blocked.
• Security: restricted pages are excluded from front-end search results for logged-out visitors and emit noindex robots directives.
• Fixed a caching edge: blocked responses send no-cache headers and hook PBJ SEO’s cacheable filter, so an edge cache can never store the 403 message as a public page — or serve a cached anonymous copy to a logged-in member.
• Added: applicants receive an “account approved” email when approved, and expired approve/deny email links now show a clear notice instead of silently doing nothing.
• Added: a pbj_access_control_post_types filter to restrict entries beyond Pages, and a pbj_access_control_login_redirect filter to send blocked visitors to the login form (with redirect back) instead of the 403 message.
• Fixed: the message sanitizer no longer strips legitimate braces from message text — only CSS-shaped rules are removed.

Version 2.0.0

• Full refactor: the single-file plugin was split into a bootstrap plus class files matching the rest of the PBJ plugin suite (orchestrator, frontend, admin, approvals, updater).
• Signup IP + location capture. Every new registration records the signup IP and best-effort city/region/country, shown as columns on Users → PBJ User Approvals and included in the approval-notification email.
• Self-hosted updater with an Update URI header that locks the slug — no risk of a same-slug WordPress.org plugin auto-replacing this one.
• Settings schema versioning with an idempotent migration runner and a migration hook, plus a proper uninstall.php cleanup.
• Fixed the WordPress 6.7+ early-textdomain notice.

Version 1.06.5

• Fixed missing settings field callbacks that could fatal on activation; added safe-mode behaviors — hooks deferred to init, never blocks admin/AJAX/REST, editor fallback, and a CSS-bleed sanitizer for the restricted message.