What Members does on your site
Members puts an interface on top of the WordPress roles and capabilities system, which used to be reserved for people who could code it by hand. Under Members > Roles, you create, clone, edit or delete a role, tick its capabilities and can explicitly deny some of them. A user can hold several roles, and roles can be exported and imported as JSON.
The plugin also restricts who can read your content: a “Content Permissions” box in the editor limits a post or page to certain roles and shows everyone else an error message. It can make the whole site private, add a login form through a shortcode or widget, and show or hide blocks based on login status, role or capability. Since version 3.3.0, an MCP-compatible AI assistant (Claude, Cursor, VS Code...) can look up and manage roles and restrictions, read-only by default.
Members is published by MemberPress, the company behind the paid membership plugin of the same name. It is completely free, add-ons included (Admin Access, Role Hierarchy, Block Permissions, and integrations for WooCommerce, ACF, Easy Digital Downloads, GiveWP and Meta Box): its job for the vendor is to point sites that want to sell access toward MemberPress.
Which sites Members is a good fit for
Members answers the question “who can do what” on your site, without charging your visitors anything:
- Sites run by an agency or several writers: a role such as “Editor without publishing” or “Limited shop manager” applies least privilege without writing code.
- Intranets, project sites and staging sites: the private site feature sends every logged-out visitor to the login page.
- Simple, free members areas: a few pages reserved for logged-in subscribers, with the login form inside the error message.
- Stores and donation sites: the add-ons bring WooCommerce, Easy Digital Downloads and GiveWP capabilities into the role editor.
It is the wrong tool for selling memberships: Members has no registration form and no payments. You need a membership plugin such as MemberPress for that. If all you want is a role editor, User Role Editor is the other common free option.
Members strengths and limitations
Strengths
- Everything is free. All twelve add-ons, including Admin Access and Block Permissions, are included, with no paid tier.
- A complete role editor. Multiple roles per user, denied capabilities, cloning and JSON import with a role-by-role preview.
- Safeguards against lockouts. An emailed rescue link restores the Administrator role, and one button puts the five WordPress roles back to their defaults.
- Built on WordPress APIs. Members edits the native roles, which other plugins read without any adaptation.
Limitations
- Protection covers content only. Titles, menus, search results, custom fields and uploaded files stay accessible.
- No registration, no payments. To sell access or create accounts, you need another plugin.
- Patchy page builder coverage. Some page builders slip past the protection, and on a WooCommerce product only the description is hidden.
- Changes are permanent. Edited roles stay in the database after deactivation: a mistake has to be fixed by hand or with a reset.
- A push toward MemberPress. Without MemberPress, a “Payments” menu shows a mock transactions table that leads to the paid product.
The Members settings we recommend
The screens live under Members > Settings (General tab unless noted) and Members > Add-Ons. Export your roles (Members > Roles, “Export All”) before changing anything.
| Setting | Recommended value | Why |
|---|---|---|
| Role Manager Members > Settings > Roles and Capabilities | On (default) | It unlocks Members > Roles; every change is written straight to the database. |
| Capabilities: denied capabilities overrule granted ones Same section | On (default) | When a user holds two roles, a capability denied by one wins over the same capability granted by the other. |
| Enable Permissions Content Permissions section | On if Members protects your content, off if MemberPress does | When two plugins protect the same page, visitors must pass both checks, and a paying member can get locked out. |
| Hide Protected Posts from WP REST API Same section | On (default) | Protected posts drop out of REST API responses; then check any calendar or post list that reads from it. |
| Enable Private Site Private Site section | Off (default), on for an intranet or staging site | Every logged-out visitor is sent to the login page, including your sales pages. |
| REST API (require authentication) Private Site section | On for a private site, after testing | Without it, the REST API keeps answering logged-out visitors; test the forms and apps that rely on it. |
| Disable Feed Private Site section | On for a private site | RSS feed items are replaced by an error message instead of publishing your content. |
| Admin Access Members > Add-Ons, then Members > Settings > Admin Access | Subscriber unticked (and Customer with WooCommerce) | Those accounts are sent to the front end instead of the dashboard, and the toolbar can be hidden for them. |
| AI assistant read-only mode Members > Settings > AI (MCP) | On (default) until you need more | The assistant can look things up but change nothing; it connects with an application password you should revoke when you stop using it. |
- Open a restricted page in a private browser window: the error message should replace the content.
- Log in with a test account for each custom role: a role without the
readcapability cannot open the dashboard. - Make sure your site actually sends email: the rescue link at
wp-login.php?action=members_rescuedepends on it and expires after 15 minutes. - Do not attach confidential files to a protected page from the Media Library: their URL stays public.
Members security: leaks of restricted content
The known vulnerabilities in Members do not hand over control of the site: they let a visitor without an account read or infer restricted content through a path the protection did not cover. The two CVEs on record:
- CVE-2024-11008, fixed in 3.2.11: WordPress search could be used to extract data from posts restricted to higher roles, without an account (CVSS 5.3).
- CVE-2026-12426, fixed in 3.2.23: REST API pagination revealed whether restricted posts existed and how many, and worked as an oracle to guess the words inside them (CVSS 5.3).
Later releases closed other paths without a CVE: comments readable through the REST API (3.2.25), and the Latest Posts block in full-content mode and the Latest Comments block (3.3.1). Turn on automatic updates for Members under Plugins (see our guide to automatic plugin updates). WP Masquerade Pro replaces the Members folder path in the files your pages load and removes the IDs of its scripts and styles, which makes the plugin harder for bots to spot, without replacing updates.
What WP Masquerade hides for Members
Pro Handled by WP Masquerade Pro only
The free version does not know the traces specific to Members: without Pro, only generator tags are removed, as for any plugin.
Free version
Handled by WP Masquerade Pro only
With Pro
- folder name
- tag IDs
Still visible
No known trace
Frequently asked questions about Members
Is Members really free?
Yes. There is no paid version of Members, and all of its add-ons are included. The vendor sells MemberPress separately, a different paid plugin for selling memberships.
What if I locked myself out of the dashboard?
Open wp-login.php?action=members_rescue, enter the email of an account that has or had the Administrator role, and use the link you receive within 15 minutes. Custom or cloned roles are not eligible.
Will my roles disappear if I delete Members?
No: Members edits the WordPress roles themselves, and they stay after deactivation or deletion. To roll back, delete your custom roles and use Reset Roles under Members > Settings before uninstalling.
Does Members protect PDF files on a restricted page?
No. Protection covers the content, excerpt and comments; an uploaded file stays reachable by anyone who knows its URL. For that, the vendor points to the downloads feature of MemberPress.
Does Members work on multisite?
Yes. Each site has its own roles, and import/export copies them between sites. By default, only Super Admins can create, edit and delete roles.