Build A Members Area With WebBlocks Memberships

Memberships connects four things that are easy to confuse:

A visitor account is separate from a CMS administrator account. Registering as a member does not allow someone into the admin panel. A package has no price of its own: a paid plan supplies the price, billing interval and payment-provider choice.

You can use accounts, free packages, manual grants and protected pages without Commerce. Paid recurring subscriptions require compatible Commerce payment providers. Adding a Commerce Buy Button sells a one-off product; it does not create a recurring Memberships subscription.

For developer endpoints and integration details, see the Memberships reference. This guide follows the work in the panel and the visitor account screen.

Use a test installation while learning the workflow. You need:

• A working WebBlocks CMS site and a Super admin account for plugin installation.
• A compatible release: Memberships 0.2.0 requires CMS ^1.100.0; its catalogue compatibility lists PHP 8.4 and Laravel 13. Check the catalogue against the actual installation.
• Permission to manage Memberships and edit pages for the chosen site. The plugin supplies a Site Admin permission; the user's site assignment still applies.
• A correct canonical site domain and working CMS outbound mail for verification and password reset.
• For paid plans later: Commerce ^0.16, a configured PayPal or SumUp provider, a public HTTPS callback address and a working Laravel scheduler.

Ask the hosting administrator to verify mail delivery with a test mailbox before inviting members. The local screenshot environment uses synthetic accounts; it does not demonstrate delivery to a real inbox.

Memberships is listed as free in the plugin catalogue. Merchant accounts and payment processing are separate services.

1. Sign in as Super admin and open System → Plugins.
2. Select Browse Plugin Catalog and open Memberships.
3. Review compatibility and the selected release, then choose Install from Catalog.
4. Open the installed plugin's detail screen and choose Enable Plugin. Newly installed packages start disabled so that you can review them first.
5. Check the plugin's health and database setup result before inviting visitors.

If your administrator supplies a trusted release ZIP, use Plugin ZIP → Upload Plugin ZIP, review it and enable it. The panel installation route does not require a store owner to build the plugin from source.

Current CMS releases apply plugin database changes during installation, update and activation. If setup fails, resolve the reported error before continuing. A mail or provider warning is a different readiness issue from missing database tables.

Open Memberships in the sidebar. Confirm the site name at the top is your intended site. In 0.2.0, the management URL accepts ?site_id=...; when no site is supplied, the panel chooses the first authorized site. On a multisite installation, have the administrator open the correct site-specific management URL and verify the heading before changing packages, accounts or page access. This version does not provide a separate site selector inside the Memberships form.

A package groups access rights. Start with a free one so that you can test the complete account and page-access flow without a payment provider.

In the Memberships screen, scroll past existing packages to the empty Packages form:

1. Enter Studio community in Name.
2. Enter Free access to the Northstar Studio member reading room. in Description.
3. Select Allow free self enrollment.
4. Select that form's Save button.

The new package is active when created. Its saved form shows a Package ID, Active and Allow free self enrollment. Keep the ID for later steps.

Only active packages that allow free self enrollment appear as free choices for visitors. A verified visitor can join them without an operator or payment approval. Free enrollment creates a membership without an end date.

Create a second package named Workshop circle, with description Workshop resources for invited participants. Leave Allow free self enrollment unchecked. You will grant this package manually in step 7, or attach it to a paid plan later.

Keep free self enrollment off for a package that should require payment or an invitation. Otherwise a verified visitor can obtain the same package through the free route. A separate paid plan does not override an available free grant.

You can link directly to /plugins/webblocks-memberships/account, or use native blocks on an ordinary CMS page.

Create a draft page called Join Northstar Studio, or prepare a staged update to an existing join page. Use the same site as your packages. Add a heading and a short explanation of what membership includes, then:

1. In the page's Main slot, select Add Block.
2. Choose My membership account, the native Memberships account block.
3. Save the block.
4. Optionally add Available free packages, the native package-list block.
5. Preview the page.

The account block renders a My membership account link. Registration, sign in, password reset and account management happen on the separate account page. The block does not embed a registration form in your editorial page.

The package-list block shows active packages that permit free self enrollment, with Join free package links. Visitors still need to sign in and verify their email before enrollment succeeds. For a persistent header link, add a navigation item named Member account pointing to the account route; see Navigation Menus.

Preview first, then publish your join page only when its copy, links and registration mail are ready. An editorial draft preview is not a sandbox for account actions: registration, enrollment and billing requests still use the installation's actual member records.

Open the account link in a separate browser profile or private window. This makes it easier to distinguish the visitor's session from your administrator session.

The first registration form asks for Name and Email. It deliberately does not ask a new visitor to set a password before proving ownership of the mailbox.

1. Under Create account, enter a test name and an email address you control.
2. Select Create account.
3. Open the verification email on the same site's canonical domain.
4. Follow the link, set Password and Confirm password, then select Continue.
5. Return to Sign in, enter that email and password, and sign in.

Verification links expire after 24 hours. Opening the link displays a confirmation form; submitting that form completes verification and sets the password. Merely viewing the email link does not consume it.

If the email does not arrive, check the recipient's spam folder, CMS outbound mail and the canonical domain. Use the account flow's resend option when available. For a pending account, Request password reset issues a verification link rather than bypassing mailbox verification. Do not create a second account to work around a mail problem.

A signed-in unverified visitor cannot enroll in packages or open member-only content. Verification and the account's active state are both required. Resetting a password invalidates earlier member sessions.

After sign in, My membership account shows the visitor's name and email, a profile-name field, existing memberships, subscriptions and available packages.

Our synthetic account already has a dated Workshop circle grant to illustrate the operator workflow in step 7. A newly registered visitor will initially have no memberships.

Under Available free packages, find Studio community and select Join free package. The account's membership list now includes Studio community, its start time, No expiry and Active.

This enrolls the visitor in the free package; it does not create a payment authorization or a paid subscription. A visitor cannot use free enrollment to extend or overwrite an existing operator grant. If a previous grant has expired or been revoked, ask the operator to review and extend it rather than repeatedly pressing Join.

Create a page named Studio reading room on the same site. Add the member content and review it before changing access. Remember its page title so that you can find it in the Memberships form.

Open Memberships, scroll to Page access, then:

1. Choose Studio reading room in Page.
2. Choose Package holders in Access.
3. Choose Studio community in Package ID.
4. Select that form's Save button.

There are three access choices:

A page can require one selected package through this form. The same package can be obtained through a manual grant or a verified paid period; those are independent sources of access.

If the reading room is a draft, publish it only after checking the rule. The Page access form changes access policy immediately; it is separate from the page's content draft or staged update. Do not assume saving the rule is deferred until a later content promotion. Recheck the live page and use a test site while learning.

Test the direct page URL in two visitor sessions:

• Signed out: the reading-room content must remain inaccessible.
• Signed in as the verified Studio community member: the page must open.

Use the visitor route for this test, not an administrator preview. Also test a verified account without the required package when you have one: verification alone must not open a package-protected page.

Protected pages are omitted from public search, the sitemap and automatic page navigation. Give members an intentional link, for example in your join-page instructions, rather than relying on an automatic page list to advertise the reading room.

Protection stays in place if Memberships becomes unavailable. Restoring an older content revision does not remove the current access rule. Copies inherit restrictions; cross-site package rights need explicit reassignment. Do not treat a content restore or plugin disable action as a way to make a page public. To reopen it deliberately, select Public in Page access and save.

Use a manual grant when someone has an invitation, an offline arrangement or a fixed workshop entitlement.

Find the visitor's Member ID in the Members table and the Package ID above the saved Workshop circle form. These IDs identify records in the selected site; they are not account passwords or an invitation code.

Scroll to Grant or extend membership and enter:

Select Save. The grant appears under Membership grants, and the member sees it on the account screen.

The panel labels these dates UTC. Convert the intended start and end from your site's local timezone before entering them. The visitor account displays dates in the site's configured timezone. A future start has not begun yet; an end at or before the current time has expired. Leave Ends at UTC blank only when you intend a membership without an end date.

To extend the same member/package grant, enter those same IDs again with the desired complete start and end dates and save. This updates that grant rather than creating a duplicate. It also clears a previous revocation, so review the full period before saving.

For a lasting test, choose dates that cover the day you are testing; the screenshot's fixed dates are an example, not values to reuse indefinitely.

Revoke in Membership grants removes that manual grant's entitlement. It does not cancel a separate paid subscription, and a member may still have access through another current entitlement for the same package. Review both grants and paid payments when investigating access.

Disable account in the Members table prevents the account from signing in or using existing member sessions. It also requests cancellation of that member's renewals. Re-enabling the account requires a fresh sign in; it is not a new payment authorization.

Turning off Active on a package makes that package unavailable for access and requests renewal cancellation for its subscriptions. Treat package deactivation as an access and billing change, not merely hiding a card from a list.

For paid memberships, follow the cancellation checks in step 11 as well. A queued cancellation still needs provider confirmation; disabling local records is not evidence that an external agreement has ended.

Finish the free workflow first. For paid plans, configure Commerce 0.16.x and its PayPal or SumUp provider with the administrator. Memberships reuses that provider configuration; there is no second credentials form in Memberships.

The Commerce walkthrough explains installation and provider settings. Its Test order (no payment) option is for one-off Commerce orders. It cannot produce verified recurring Memberships payments or paid access.

Before offering a plan:

1. Configure the intended provider in Commerce → Settings, starting with its sandbox environment and matching test merchant account.
2. Check the provider's credentials, supported currency and readiness.
3. Set a publicly reachable HTTPS canonical domain for the membership site.
4. Verify callback delivery. PayPal uses the existing Commerce webhook with subscription and sale events; SumUp uses the Memberships billing callback.
5. Have the hosting administrator run the host application's Laravel scheduler every minute and verify its heartbeat.
6. Confirm the package is active and Allow free self enrollment is off if payment should be required.

Memberships registers webblocks-memberships:billing:sync every five minutes. PayPal carries out its native renewal charges; the local task reconciles provider evidence and access. For SumUp, the task also processes authorized due renewals. An administrator can run the command to investigate reconciliation, but should understand that it can process due authorized SumUp charges. It is not a preview-only diagnostic command.

The PayPal webhook is /plugins/webblocks-commerce/webhooks/paypal. Add the relevant BILLING.SUBSCRIPTION.* and PAYMENT.SALE.* event topics in the PayPal app's webhook subscription. The SumUp recurring callback is /plugins/webblocks-memberships/billing/webhooks/sumup, distinct from Commerce's one-off-order callback. Use the canonical HTTPS host, not a localhost address from a screenshot.

Follow the current PayPal Subscriptions documentation and SumUp saved-card guide for provider account requirements. A successful one-off checkout alone does not verify recurring billing support for that merchant.

In Memberships → Paid plans, fill in the plan form:

Amount in minor units is an integer. For a €10 plan enter 1000, not 10 or 10.00. Currency precision varies; do not assume every currency uses cents. Monthly interval counts are 1–12. A yearly plan uses year(s) with count 1.

Select Save only after provider configuration is ready. Check the saved plan's displayed amount and package association. The screenshot shows the form before submission, with no configured merchant credentials; it is not proof of a working provider connection.

Existing subscriptions retain their agreed price and billing cadence. Create a new plan when the price changes. Do not assume a replacement plan silently updates existing authorizations.

On the account page, a verified member finds Paid plans, chooses an available Payment provider, and selects the explicit consent checkbox:

I authorize the stated recurring subscription charge until I cancel renewal.

Then they select Subscribe. A paid plan needs both its provider enabled and that provider available; an empty provider list or disabled Subscribe button is a readiness problem to resolve, not a reason to turn on free enrollment.

PayPal: the member follows Approve with PayPal and approves the recurring agreement at PayPal. Returning to the website is not payment proof. Use Check payment status and verify that the server confirms a paid subscription period before expecting package access.

SumUp: the member completes the provider's card widget and any authentication required for saved-card recurring payments. Its temporary 1-unit setup charge is reimbursed; for a EUR setup this means €1.00. That setup does not pay the €10 subscription or unlock the package. Access begins only after a verified subscription payment. Raw card details belong in the provider widget, never in an ordinary CMS block.

The member can open Manage subscription from the account screen. Operators see Subscriptions below Paid plans, with Check payment status, Cancel renewal and a payment history table.

Test cancellation in the provider's sandbox before offering live plans. Select Cancel renewal, then Check payment status until external cancellation is confirmed. A cancellation request stops future renewal requests, but a payment already requested may still complete. Access normally continues until the end of the settled period, except for refunded or reversed periods.

Stop offering this plan and cancel renewal affects the entire plan and requests cancellation for its subscriptions. It is not a price-edit button or a way to hide the offer while preserving all renewals.

A completely missed SumUp period requires fresh enrollment rather than automatically charging all expired periods. Do not keep submitting a new subscription when a payment result is unknown: reconcile the existing reference first. Manual grants remain independent; revoking one does not cancel billing, and cancelling billing does not erase a valid manual grant.

Cancel external agreements and confirm the result before permanently removing Memberships, Commerce or the provider configuration. Removing local plugin code does not itself cancel a native PayPal agreement.

Only move to live provider settings after the intended merchant's sandbox has passed approval, payment confirmation, renewal, cancellation and callback checks. These provider checks require your own test account; the guide's synthetic screenshots do not replace them.

A protected page does not make an already public file URL private. Do not upload a confidential workbook to public storage and assume that hiding its page protects the file.

Have the hosting administrator prepare a private, non-public filesystem disk. A private Media Library record used by a published block on a protected page can be served through the Memberships private-download route with the same page/package access check.

The route has the form /plugins/webblocks-memberships/downloads/{page}/{media}. Use the actual page and media IDs from your installation and verify the relationship to the published block. Merely changing a media record's privacy flag cannot undo a public storage URL. Test the download while signed out and as the intended package holder.

For ordinary public downloads, see Offer A Downloadable File. Have the administrator review confidential file storage before reusing that workflow for member resources.

Appointments can optionally use Memberships to recognize a signed-in visitor, prefill customer details and associate a booking with the verified member. A service can require a verified account or a chosen active package.

Select the same site and intended package when configuring a restricted service. A paid package entitlement uses the same verified access lookup as a manual grant. There is no need to sell another Commerce product to duplicate the membership.

Ordinary guest bookings can continue without Memberships. Restricted services remain unavailable when the required member service is unavailable. Changing a member's access does not rewrite the customer snapshots on past appointments. See the Appointments reference for its separate service setup.

Confirm that the join page explains the offer, account links open the correct site, verification mail arrives, and a verified visitor can join the intended free package. Check the protected page while signed out, without the package and with current package access. Confirm UTC grant dates and verify that paid-only packages do not allow free enrollment.

If you offer recurring payments, additionally verify the provider's sandbox, callbacks, scheduler, current-period access and confirmed cancellation. Publish only the pages you have reviewed, then repeat the direct visitor and download checks on the public HTTPS site.

Continue with the Memberships reference, the Commerce walkthrough, Navigation Menus or Roles And Permissions.