Member sign-in lets a visitor prove, on your WordPress site, that they are a member of your memberarea. It is what makes locked pages, My Courses and Course Progress work. Setting it up is described in Connecting WordPress to memberarea; this article is about what it does once it runs.
What the member sees
They press Sign in, land on your memberarea, approve the connection once, and come back to the page they started on, signed in. The approval page names what your site receives: their name, their email address if you chose to share it, and which courses, groups and products they have access to. Its button reads "Continue to" followed by your site's name. If they are already signed in to your memberarea and have approved before, the whole trip takes a second and asks nothing.
From then on the Member Login block shows their name, their picture and a sign-out link. Nothing else on your site changes: they see the same theme, the same menus, and the pages you unlocked for them.
Their password never reaches WordPress. Your site receives a one-time code and exchanges it for a session on the server, which is why sign-in needs HTTPS and a permalink structure other than "Plain".
Visitors without an account
A visitor who is not signed in to your memberarea lands on its sign-in page first. If your memberarea is open for registration, that page also offers Create account; after registering, they sign in and continue to your site.
Somebody who signs in but has no active membership in your memberarea, for example because you banned or deactivated them, sees a page "No access to" followed by your site's name, with a button back to your site. No code is issued, so they stay signed out on WordPress.
No WordPress account is created
Members do not become WordPress users. They never appear under Users, they
have no role, no dashboard access and no author page, and your existing
WordPress accounts are untouched. Your editors keep signing in the usual way at
/wp-login.php.
That separation is deliberate: your member list stays in one place, your memberarea, and cancelling a membership there closes the door here without any cleanup in WordPress.
How long a session lasts
A session ends by itself after a day without a visit, and after 30 days at the latest. While it runs, your site keeps checking with your memberarea:
- Access to a course, group or product is cached for two minutes, course lists for one minute. When somebody buys, upgrades or loses a course, group or product, WordPress follows within two minutes.
- Whether the member may still sign in here at all is checked every 10 minutes. A member you ban or remove, or who revokes access, loses content for Signed-in members within 15 minutes. Content bound to a course, group or product closes for them within two minutes.
To see a course, group or product change immediately, press Clear cached responses under Status on the settings screen. It does not end sessions, so it does not speed up a ban or a removal.
Members can disconnect a site
A member can withdraw their approval at any time in their profile in your memberarea: on the Security tab, under Connected websites, they press Revoke access. Content bound to a course, group or product closes for them within two minutes, content for Signed-in members within 15 minutes. The next time they press Sign in on your site, they are asked to approve the connection again.
The revocation shows up as "Website access revoked" in Recent security activity on the Devices tab of their profile.
Signing out
Signing out on WordPress always ends the WordPress session. What happens in your memberarea depends on one switch on the settings screen: Signing out here also signs the member out of the MemberArea, off by default.
- With the switch off, the member is signed out of your WordPress site and stays signed in to your memberarea.
- With it on, they are taken to the memberarea to finish signing out, and they stay there.
Leave it off if your WordPress site is one of several places a member uses.
The email address
When you set member login up, you decide once whether your site receives the member's email address. Leave it off unless something on your site really needs it: a newsletter form you fill in for them, or a plugin that matches people by address.
The setting is read-only afterwards. To change it, switch member login off and set it up again. Members stay members either way. Switching login off deletes every member's approval, so each member signs in again and approves the connection once more.
When the memberarea is down
If your memberarea cannot be reached, members who are already signed in stay signed in for up to 15 minutes: a server that does not answer says nothing about a membership. What they can read depends on the rule:
- Content for Members with a course, Members in a group or Members who bought a product closes within two minutes at the latest. A membership that cannot be checked keeps protected content closed rather than opening it by accident.
- Content for Signed-in members stays open to them for those 15 minutes. After that their session ends, so a member you remove during the outage cannot keep reading.
Nobody can sign in anew until your memberarea answers again.
When it stops working
Two findings on the Status panel mean that sign-in itself is broken: The site address changed after sign-in was set up and The MemberArea no longer knows this website. Both are fixed by setting member login up again. The server clock plays no part in sign-in.
Details and the full list are in Troubleshooting the WordPress connection.