What MemberPress does on your site
MemberPress turns a WordPress site into a paid membership area. You create memberships, each with its own registration and checkout page, then rules that reserve content for their subscribers: a page, a post, every post in a category or tag, a post type, a specific passage through a shortcode, or a whole address through a “Custom URI” rule. Each rule can release content gradually (drip) or make it expire after a set time.
On activation, a setup wizard walks you through the basics and the plugin creates its reserved pages: login (/login), member account (/account) and the post-purchase thank-you page (/thank-you). Registration pages follow the /register/membership-name format and group pricing pages the /plans/group-name format. MemberPress handles recurring subscriptions (upgrades, downgrades, pausing, cancellation by the member), coupons, reminder emails and VAT, and includes a course module (MemberPress Courses) with quizzes, assignments and certificates depending on the plan.
The developer is the US company Caseproof, LLC. The plugin is paid only, with no listing on wordpress.org, and sold in three annual plans (Launch, Growth and Scale). It requires at least PHP 7.4, MySQL 8.0 and WordPress 6.0, and ships translated into French, German, Spanish, Italian, Japanese and Brazilian Portuguese.
Which projects MemberPress suits best
MemberPress fits when subscriptions are the core of your business model:
- Creators and premium publishers: posts, videos or resources reserved for subscribers, with drip release and a paywall that allows a few free views.
- Course creators: the course module covers a simple catalog (unlimited courses and lessons from Launch) without adding an LMS plugin.
- Coaches and communities: the Growth and Scale plans add private forums, a member directory and CoachKit for tracking clients.
- B2B sales: the Scale plan handles corporate accounts with sub-accounts, plus gift memberships.
It is not the right pick if your budget is zero (Ultimate Member has a free version on wordpress.org), if you mostly sell physical products (a WooCommerce store fits better), or if training is your main business with complex learning paths: a dedicated LMS such as LearnDash goes further.
MemberPress strengths and limitations
Strengths
- Very granular access rules. Pages, posts, taxonomies, post types, text passages, page builder sections and file addresses, with drip and expiration.
- Full subscription handling, no extra plugin. Prorated upgrades and downgrades, pausing, self-service cancellation and automated reminder emails.
- Courses included. Unlimited courses and lessons from the Launch plan; quizzes, assignments and certificates from Growth.
- Built-in protections. Math captcha, Cloudflare Turnstile, a password strength meter and blocking of stolen-card testing.
Limitations
- Introductory pricing in year one. The listed prices are promotional and renewals are at full price, which is double ($399 per year for Launch).
- A restricted Launch plan. A 4.9% fee on every successful payment and Stripe as the only gateway; PayPal and Square require Growth.
- File protection tied to Apache. Static file rules rely on .htaccess; on Nginx, the developer recommends the Downloads add-on, included in Scale.
- Conflicts with page caching. The paywall and search engine access do not work while page caching is active.
- No native multilingual support. Polylang, WPML or TranslatePress translate most of it, but the reserved pages need a workaround.
The MemberPress settings we recommend
These settings live under MemberPress > Settings, on the Account, General and Pages tabs, with the labels used in the official documentation. Click “Update Options” after each tab.
| Setting | Recommended value | Why |
|---|---|---|
| Password Strength Meter MemberPress > Settings > Account | “Show & Require Medium Password or Stronger” | The level the developer considers enough for most sites: it rejects weak passwords at signup. |
| Enable Math Captcha Same tab | On, unless another captcha already protects these forms | Adds a simple math problem to the MemberPress login and registration forms to cut bot signups. |
| Keep members out of the WordPress Dashboard Same tab | On | Members are redirected away from wp-admin and manage everything from their account page. |
| Disable the standard WordPress registration form Same tab | On if “Anyone can register” is checked under Settings > General | Signups then go only through MemberPress forms; otherwise the option has no effect. |
| Enable Card Testing Protection MemberPress > Settings > General | On | Permanently blocks a user after 5 failed payments within 2 hours, the signature of stolen-card testing. |
| Enable automatic, background updates Same tab | “All Updates”, or at least “Minor Updates Only” | Security fixes arrive without waiting for a manual update. |
| Enable WP Rest API search discovery protection Same tab | On only if no other brute-force protection is in place | Slows content discovery through the REST API; the developer warns it can affect other plugins, so test them after turning it on. |
| Redirect unauthorized visitors to a specific URL MemberPress > Settings > Pages > Unauthorized Access | On if your theme or page builder outputs content outside the_content() | Rules only protect what goes through that function; the redirect protects the whole page. The destination page must not be covered by any rule. |
- Test your rules with a member account or in a private window: MemberPress ignores every rule for administrators.
- Make sure the account page is not covered by any rule: an expired member must still be able to update their card there.
- Open the direct URL of a protected PDF in a private window: MemberPress should ask you to log in. If not, your server is not applying .htaccess.
- If a firewall filters requests, allowlist your payment gateway’s IP addresses; otherwise some transactions end up without a valid ID.
MemberPress security: patched flaws worth tracking
The WPScan and Patchstack databases list eight patched vulnerabilities since 2024, including these:
- CVE-2026-92797, fixed in 1.14.2: a CSRF flaw let an attacker change the email address of a logged-in member who clicked a crafted link, then take over the account through password reset.
- CVE-2024-11299, fixed in 1.12.0: without an account, WordPress search could reveal the text of content restricted to higher roles.
- CVE-2024-43956, fixed in 1.11.35: a missing authorization check, exploitable without an account.
- CVE-2024-5031, fixed in 1.11.30: with a contributor account, the
mepr-user-fileshortcode allowed blind SSRF, requests sent by the server to internal services.
The useful move: turn on automatic updates in the MemberPress settings and never leave a version older than 1.14.2 online. On the payments side, our guide to protecting a store against card fraud applies to a membership site too. WP Masquerade Pro hides the plugin folder and the IDs of its scripts and styles, which makes it harder for bots targeting these flaws to spot it without replacing the update; the mepr-* CSS classes stay visible.
What WP Masquerade hides for MemberPress
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to MemberPress: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
- JavaScript variables
MeprI18n - CSS classes
mepr-*, mp_wrapper
These traces stay because the plugin needs them to work (scripts, styles, cookies) or because they come from the server.
MemberPress FAQ
Is there a free version of MemberPress?
No. MemberPress is sold only as annual plans, with a 14-day money-back guarantee according to the official pricing page.
How much does MemberPress cost, and does the price go up at renewal?
The official page lists $399, $699 and $999 per year for Launch, Growth and Scale, in US dollars ($199.50, $349.50 and $499.50 for the first year): annual renewals are at full price.
What are the Launch plan transaction fees?
Launch takes 4.9% of every successful payment, on top of Stripe’s own fees. Moving to Growth or Scale removes the fee from future payments and renewals.
Does MemberPress work with a caching plugin?
According to the official documentation, the free-views paywall and the option that lets search engines read protected content do not work while page caching is active, whether it comes from a plugin or from your host.