Make WordPress Posts or Categories Members-Only: Plugin and Code

This article is a localized edition of the Japanese original. Read the Japanese original

When you want to limit "just this post" or "just the posts in this category" to members in WordPress, treat members as users who can log in to WordPress, and do not show the content to people who are not logged in.

This article covers what WordPress can and cannot do on its own, how to restrict individual posts with the Members plugin, and code that hides the content of a whole category. The code was tested in a WordPress 7.1 test environment as of November 2026.

Let members register

If members create their own accounts, set these two options under Settings → General in the admin.

1. Under "Membership", check "Anyone can register"
2. Set "New User Default Role" to "Subscriber"

People can then register at wp-login.php?action=register. A Subscriber can only edit their own profile in the admin, which suits members. If an administrator adds members one by one, leave registration off and create them under Users → Add New User.

If you want extra fields on the registration form or want to approve registrations, use a registration plugin (How to set up the User Registration plugin).

How this differs from the built-in “Private” and “Password protected”

A post's visibility can be set to "Private" or "Password protected", but neither fits a members-only use.

WordPress itself has no feature for restricting a whole category. You do it with a plugin or code.

Method 1: Restrict individual posts with the Members plugin

Members (plugin slug members) is a plugin for editing user roles. It lets you restrict each post or page so that only users with certain roles can read the content. As of November 2026 the current version is 3.3.1.

Setup steps

1. Go to Plugins → Add New Plugin, search for "Members", then install and activate it.
2. Open Members → Settings and confirm that "Enable Permissions" under "Content Permissions" is on (it is on by default).
3. On the same screen, set the text shown to people without permission in "Error Message". The default is "Sorry, but you do not have permission to view this content.", so change it to your own message.
4. Open the post you want to make members-only and, in the block editor sidebar under "Content Permissions (Members)" (the "Content Permissions" box in the Classic Editor), check the roles that may read it, then click Update. To let every logged-in member read it, check all roles, including "Subscriber".

Anyone who has at least one of the checked roles can read the content.

What Members protects

According to the plugin's description, it restricts the content, excerpt and comments. Titles, menus, search results, custom fields and uploaded files (PDFs, images) are not hidden. By default, restricted posts are also removed from REST API listings ("Hide Protected Posts from WP REST API").

Content Permissions in Members is a per-post setting; it has no feature for restricting a whole category at once. To restrict by category, use the code below, or choose a membership plugin that can restrict categories (Comparing WordPress membership plugins).

Method 2: Hide the content of a whole category with code

This code replaces the content of posts in a "Members only" category (slug members-only) with a notice for people who are not logged in.

Preparation

1. Under Posts → Categories, create a category with the slug members-only (any name is fine).
2. Assign this category to the posts you want to make members-only.

The code

Save it as wp-content/mu-plugins/members-only.php (create the mu-plugins folder if it does not exist). PHP files in this folder load automatically and keep working even if you switch themes. If you put it in a child theme's functions.php, paste it without the opening <?php.

<?php
/**
 * Plugin Name: Members-only category
 * Description: Hide the content of posts in the "members-only" category from people who are not logged in.
 */

// Slug of the members-only category
const WPDR_MEMBERS_CATEGORY = 'members-only';

/**
 * Whether the post is in the members-only category.
 */
function wpdr_is_members_only( $post = null ) {
	$post = get_post( $post );
	return $post && 'post' === $post->post_type && has_category( WPDR_MEMBERS_CATEGORY, $post );
}

/**
 * Notice shown to people who are not logged in.
 */
function wpdr_members_only_notice( $post = null ) {
	$login_url = wp_login_url( get_permalink( $post ) );
	return '<p>This post is for members only. <a href="' . esc_url( $login_url ) . '">Log in</a> to read the rest.</p>';
}

// Replace the content (applies to post pages, lists, feeds and content.rendered in the REST API)
add_filter( 'the_content', function ( $content ) {
	if ( is_user_logged_in() || ! wpdr_is_members_only() ) {
		return $content;
	}
	return wpdr_members_only_notice();
}, 999 );

// Replace the excerpt (hand-written excerpts do not go through the_content)
add_filter( 'get_the_excerpt', function ( $excerpt, $post ) {
	if ( is_user_logged_in() || ! wpdr_is_members_only( $post ) ) {
		return $excerpt;
	}
	return 'This post is for members only.';
}, 999, 2 );

// Do not accept comments on members-only posts from people who are not logged in
add_filter( 'comments_open', function ( $open, $post_id ) {
	return ( ! is_user_logged_in() && wpdr_is_members_only( $post_id ) ) ? false : $open;
}, 10, 2 );

The code uses the the_content filter to replace the content because not only the post page but also the RSS feed and the REST API (/wp-json/wp/v2/posts) pass the content through this filter. In the test environment, when not logged in, the content was replaced with the notice on the post page, in the feed and in the REST API, and after logging in the original content was shown.

Send visitors on members-only pages to the login screen

If, besides hiding the content, you want to send people who are not logged in to the login screen when they open the category list or a post page, add the following code. After logging in, they return to the original page.

<?php
// Send people who are not logged in from the members-only category list and its post pages to the login screen
add_action( 'template_redirect', function () {
	if ( is_user_logged_in() ) {
		return;
	}

	if ( is_category( 'members-only' ) ) {
		$back = get_category_link( get_queried_object_id() );
	} elseif ( is_singular( 'post' ) && has_category( 'members-only', get_queried_object_id() ) ) {
		$back = get_permalink( get_queried_object_id() );
	} else {
		return;
	}

	wp_safe_redirect( wp_login_url( $back ) );
	exit;
} );

template_redirect runs only when a theme page is displayed, so it does not affect feeds or the REST API. Do not rely on the redirect code alone; combine it with the content-replacing code above.

What neither method hides

• Titles, featured images and listings in category lists: people can still tell the post exists. Avoid putting too much of the content in the title.
• Uploaded files: anyone who knows the URL can open a Media Library file. Members-only PDFs and similar files need a separate mechanism that restricts file delivery.
• Existing comments (Method 2): the code above only stops new comments; existing comments can still be read through the REST API and the comments feed. Do not use comments on members-only posts.
• Caching: with a page cache, if the page shown to a logged-in user is cached, other people might see the content. Most caching plugins do not use the cache for logged-in users, but check your settings.

If you need paid memberships, different content per membership level, or payments, consider a plugin built for membership sites (How to build a membership site with WordPress).

Check that it works

1. Open a members-only post in a private browser window (not logged in) and confirm the notice appears.
2. Open https://example.com/feed/ and https://example.com/wp-json/wp/v2/posts and confirm the content is not shown (example.com is your site).
3. Log in with a member account and confirm the content is shown.

Summary

• Treat members as "users who can log in". To accept registrations, turn on registration under Settings → General and set the default role to "Subscriber".
• The built-in "Private" can only be read by Editors and above, and "Password protected" cannot be managed per member.
• To restrict individual posts, use Content Permissions in Members. It protects the content, excerpt and comments, but not titles or files.
• To restrict a whole category, replace the content and excerpt with the_content and get_the_excerpt. A redirect (template_redirect) alone leaves feeds and the REST API exposed.

Questions about WordPress? The publisher of this site is based in Japan and replies in Japanese. Contact (Japanese)