PBJ Access Control Changelog (v2.4.0): A Setup Checklist That Shows Your Gaps

PBJ Access Control gates WordPress pages behind login, blocks WooCommerce for logged-out visitors (with an optional escape hatch for the registration form), customizes the restricted-content message, and adds an admin-approval workflow for new registrations — capturing each signup’s IP address and location so admins can triage from the User Approvals screen or straight from the notification email. Here’s the release history.

Version 2.4.3 — approvals your staff can vouch for

• One Approve step for everyone. The Approve button and other PBJ plugins now approve through the same step, which records who approved each account, when and how.
• Logins your staff create are approved. A login made on a staff member’s say-so in PBJ CRM 7.96 (Send sign-in link, a team invitation, Team › Add) is recorded as approved, with no “awaiting approval” email to administrators.
• Deny is remembered. Deny now remembers the email address (stored only as a hash) before the account is deleted, so Send sign-in link cannot quietly let a denied person back in. Only an administrator’s own Approve button can.
• WooCommerce customers are not held up. With Require admin approval on, an account WooCommerce creates at checkout or on My Account is approved automatically, so new customers can finish checking out. Every other self-registration still waits.
• A one-time catch-up after updating: WooCommerce customers already waiting who have at least one order are approved, with no emails. A customer with no order stays waiting and is listed in the report. A denied address, or an account whose PBJ CRM access was removed, is never approved.
• For developers: new pbj_access_control_user_approved, pbj_access_control_user_pending and pbj_access_control_user_denied actions and a pbj_access_control_preapproved filter.

Version 2.4.2 — waiting accounts stay waiting

• Fixed: an account waiting for approval could still sign in to PBJ CRM with an emailed sign-in link, a passkey, an invitation or the app. Those are now refused too (needs PBJ CRM 7.95).
• Fixed: the Approve and Deny links in the “new user awaiting approval” email always said the link had expired. The email now has one link that opens Users › PBJ User Approvals with that account marked.
• Updated the built-in license client: replacing or clearing a license key now frees this site’s slot on the old key, and the update download link is signed fresh at the moment WordPress downloads the update, so “Update now” no longer fails on an expired link.

Version 2.4.1 — license client refresh

• Updated the built-in license client: it now warns when an older copy loaded first on a site running several PBJ plugins. No change to licensing or to the plugin itself.

Version 2.4.0 — a setup checklist that shows your gaps

• Setup checklist at the top of Settings → Access Control: live status rows (green tick / red triangle) showing how many Pages are currently restricted, whether WooCommerce blocking is on (shown only when WooCommerce is active), whether registration approval is on plus how many users are waiting in the approval queue, and whether the restricted-content message is set — each with a one-line explanation and a button linking straight to where you fix it.
• Numbered “How to use this plugin” walkthrough covering the full workflow: restrict a Page via its meta box, optionally block WooCommerce, customise the visitor message, turn on registration approval, and approve or deny signups (with IP + location) from Users → PBJ User Approvals.
• Every settings field now carries a plain-English “what it does” description — nothing on the Settings tab is left to guessing.

Version 2.3.0 — license keys arrive

A License section was added to PBJ Access Control’s settings. Enter the PBJ license key from your purchase and the plugin unlocks automatic updates straight from pbj.tech, delivered through the normal WordPress updates screen. The plugin is fully functional without a key — a key only gates updates, never features — and one key covers up to 3 sites.

Version 2.2.0

• Built-in User Guide — a new tab on Settings → Access Control covering page restriction, WooCommerce gating, the approvals workflow, verification, troubleshooting, and a quick reference. Also linked from the Plugins list row.

Version 2.1.0

• Security: restricted content no longer readable via the REST API. Restricted pages’ content and excerpt are blanked in /wp-json/wp/v2/pages responses (and oEmbed) for logged-out requests — previously the full content was publicly readable there even though the page itself was blocked.
• Security: restricted pages are excluded from front-end search results for logged-out visitors and emit noindex robots directives.
• Fixed a caching edge: blocked responses send no-cache headers and hook PBJ SEO’s cacheable filter, so an edge cache can never store the 403 message as a public page — or serve a cached anonymous copy to a logged-in member.
• Added: applicants receive an “account approved” email when approved, and expired approve/deny email links now show a clear notice instead of silently doing nothing.
• Added: a pbj_access_control_post_types filter to restrict entries beyond Pages, and a pbj_access_control_login_redirect filter to send blocked visitors to the login form (with redirect back) instead of the 403 message.
• Fixed: the message sanitizer no longer strips legitimate braces from message text — only CSS-shaped rules are removed.

Version 2.0.0

• Full refactor: the single-file plugin was split into a bootstrap plus class files matching the rest of the PBJ plugin suite (orchestrator, frontend, admin, approvals, updater).
• Signup IP + location capture. Every new registration records the signup IP and best-effort city/region/country, shown as columns on Users → PBJ User Approvals and included in the approval-notification email.
• Self-hosted updater with an Update URI header that locks the slug — no risk of a same-slug WordPress.org plugin auto-replacing this one.
• Settings schema versioning with an idempotent migration runner and a migration hook, plus a proper uninstall.php cleanup.
• Fixed the WordPress 6.7+ early-textdomain notice.

Version 1.06.5

• Fixed missing settings field callbacks that could fatal on activation; added safe-mode behaviors — hooks deferred to init, never blocks admin/AJAX/REST, editor fallback, and a CSS-bleed sanitizer for the restricted message.