PBJ Access Control — User Guide

PBJ Access Control — Install and Usage Guide

What this plugin does

Locks individual Pages behind login, optionally gates the whole WooCommerce area for logged-out visitors, shows a customizable restricted-content message, and holds new user registrations as pending until an admin approves them (with each signup's IP and detected location shown for review).

Requirements

• WordPress 5.5+ (6.x recommended), PHP 7.4+.
• WooCommerce is optional — the Woo toggles simply do nothing without it.

Installation

1. Plugins → Add New → Upload Plugin → pbj-access-control.zip → Install Now (choose "Replace current with uploaded" when upgrading).
2. Activate "PBJ Access Control".
3. Settings carry over on upgrades; a schema migration runs automatically.

First-time setup

Open Settings → Access Control. Since 2.4.0 the page opens with a Setup checklist card — live status rows (green tick / red triangle) for restricted-page count, WooCommerce blocking, registration approval (with the number of users waiting), and the restricted message, each with a plain-English explanation and a button linking to where you fix it — followed by a numbered "How to use this plugin" walkthrough. Below the card, the settings:

1. Block WooCommerce to logged-out users — gates shop/cart/checkout/account behind login.
2. Allow access to WooCommerce registration page — keeps the My Account registration form reachable while everything else is blocked (also requires WooCommerce → Settings → Accounts "Allow customers to create an account" to be on).
3. Require admin approval for new registrations — new users can't log in until approved on Users → PBJ User Approvals.
4. Approval notification emails — comma-separated recipients; empty = site admin email.
5. Sign-up / Login Message — the WYSIWYG editor at the bottom of the page controls what blocked visitors see. "Reset message to default" restores the stock Members Only box.

To restrict a page: edit the Page and tick Access Restriction → Restrict this page to logged-in users only in the sidebar.

Daily usage

• Restricted pages just work: logged-in users see them normally; everyone else gets your message with a 403.
• When approval is on, you'll get an email per signup with the username, email, IP, and location, plus Approve / Deny links (links expire after ~24 hours — after that use the Users → PBJ User Approvals page). Approving sends the user a "your account is approved" email automatically. Denying deletes the account.

Testing as a logged-out visitor

Use a private/incognito window (or a second browser). Check: a restricted page shows the message with HTTP 403; the Woo pages redirect/block per your settings; searching for the restricted page's title returns nothing; https://yoursite.com/wp-json/wp/v2/pages/<id> shows "rendered":"" for content.

Upgrading

Upload the new zip and choose "Replace current with uploaded". Settings, per-page toggles, and pending users survive (deactivation never deletes settings; only deleting the plugin runs the uninstall cleanup).

Troubleshooting

• A member sees the "Members Only" page while logged in — a page cache served a stale copy. 2.1.0 sends no-cache on blocked responses; purge the cache once after upgrading.
• Restricted content still visible somewhere — check you're on 2.1.0+ (REST/search/oEmbed gating landed there), and remember uploaded FILES (images/PDFs) are never gated — only the page.
• Pending user says they can't log in — that's the feature; approve them on Users → PBJ User Approvals.
• No approval emails arriving — test general mail delivery (wp_mail) first; then check the recipients field for typos. Invalid addresses are dropped silently.
• Approve link in email does nothing — it expired (~24h). The page now shows an "expired" notice; use the on-page buttons.
• Registration form unreachable with Woo blocking on — enable both the plugin's "Allow access to registration page" AND WooCommerce's own "Allow customers to create an account".
• IP/location column empty — the visitor's IP was private/unresolvable or ip-api.com was unreachable (lookups have a 2s timeout and are cached 24h).

Where things live

• Option: pbj_access_control_options; schema version: pbj_access_control_db_version.
• Post meta: _pbj_restrict_to_logged_in. User meta: _pbj_pending_approval, _pbj_signup_ip, _pbj_signup_country, _pbj_signup_location.
• Transients: pbj_ac_ip_<hash> (geo cache), pbj_access_control_remote_info (updater).
• Filters: pbj_access_control_post_types, pbj_access_control_login_redirect; action pbj_access_control_migrated.
• Uninstall deletes options + transients but intentionally keeps post/user meta.