Paid Memberships Pro Integration: Protecting Member Content
XYZ Protect integrates with Paid Memberships Pro (PMPro) to protect media files based on membership levels. The plugin detects PMPro automatically — no separate add-on or premium PMPro plan is required. This guide covers setup, strategy selection, and membership tier mapping.
Requirements
- Paid Memberships Pro installed and active (the free core plugin is sufficient — no Standard or Plus plan required)
- XYZ Protect installed and connected
- At least one PMPro membership level configured
Automatic Detection
When Paid Memberships Pro is active on your site, XYZ Protect automatically:
- Detects PMPro and switches to the PMPro authorization module
- Displays a PMPro Integration section on the Content Protection tab
- Lists your membership levels for tier mapping
No manual configuration is needed to enable the integration — just install both plugins. No PMPro add-ons are required.
How This Differs From PMPro's Built-In File Protection
PMPro includes a restricted files directory and a Protected Downloads add-on. These are designed for downloadable files (PDFs, ZIPs, templates) that users explicitly click to download. Files are stored in a special directory and served through a PHP handler.
XYZ Protect solves a different problem: protecting images, videos, and media embedded directly in your page content. When a member views a protected page, every <img>, <video>, and media URL in the HTML is a standard /wp-content/uploads/ path that anyone can access directly — even without a membership. XYZ Protect rewrites those URLs so they're only accessible to authorized visitors.
The two approaches are complementary: use PMPro's Protected Downloads for gated file downloads, and XYZ Protect for inline media that renders on your pages.
Media Protection Strategy
Choose how media protection interacts with PMPro content rules:
Path-Based Strategy (recommended for most sites)
Media in protected paths is always rewritten regardless of which page it appears on. The visitor's membership level determines the protection tier they receive.
- Simpler to configure — just specify which directories to protect
- More secure — media is protected even if it appears on a public page
- Works with any file upload method (Media Library, FTP, file manager plugins)
- Use this if the same media files might appear on both public and member-only pages
PMPro Rules Strategy
Media is only rewritten on pages that PMPro restricts to specific membership levels. Public pages serve original, unprotected media URLs.
- No path configuration needed — protection follows your existing PMPro content restrictions automatically
- Public pages load media directly from your server (no media subdomain overhead)
- Better for sites where most content is public and protection should only apply in member areas
- Important: If the same image appears on both a protected and a public page, it will be unprotected on the public page. Use Path-Based strategy if this is a concern.
Membership Tier Mapping
Assign a protection tier to each PMPro membership level:
| Tier | Protection | Best For |
|------|-----------|----------|
| None | No media protection | Free/trial memberships |
| Guard Cookie | Obfuscated URLs, cache-compatible | Standard memberships |
| Encrypted URL | Per-user, time-limited, maximum security | Premium memberships |
To configure:
- Go to Settings > XYZ Protect > Content Protection
- Scroll to the PMPro Integration section
- For each membership level, select the protection tier from the dropdown
- Click Save PMPro Settings
How tier resolution works: If a member has multiple active membership levels (PMPro supports multiple memberships per user), they receive the highest tier. For example, a user with both a Standard (Guard Cookie) and Premium (Encrypted URL) level gets Encrypted URL protection.
Administrators automatically receive the highest configured tier without needing a membership. This ensures admins always see real content when previewing protected pages.
Example Configurations
Photography Portfolio Site:
- Free Membership → None (sees watermarked previews on public pages; watermarked previews should be stored in exempt/unprotected directories)
- Standard Membership → Guard Cookie (access to high-resolution gallery)
- Pro Membership → Encrypted URL (access to RAW files and exclusive collections)
Online Course Platform:
- Visitor → No access (PMPro restricts the page)
- Student Membership → Guard Cookie (course videos and materials)
- Instructor Membership → Encrypted URL (source files and master recordings)
Content Publishing Site:
- Free Tier → None (public articles with stock images)
- Subscriber → Guard Cookie (premium articles with exclusive images)
- VIP → Encrypted URL (downloadable PDFs, reports, data sets)
Adult Content Site (with CCBill):
- Free Visitor → No access (age verification + page restriction)
- Standard Membership → Guard Cookie (access to standard galleries)
- Premium Membership → Encrypted URL (exclusive content with per-user, time-limited URLs)
PMPro's native CCBill gateway support makes it a natural fit for adult content sites that need both high-risk payment processing and media file protection.
What Happens When PMPro Is Deactivated
If Paid Memberships Pro is removed or deactivated, XYZ Protect falls back to WordPress Login authorization — any logged-in user is authorized. Your PMPro-specific settings (tier mappings, strategy selection) are preserved and will restore automatically if PMPro is reinstalled.
A notice appears in the plugin settings: "Paid Memberships Pro was previously configured but is no longer detected. Content protection has fallen back to WordPress Login."
PMPro Protected Downloads vs XYZ Protect
If you're using both PMPro's Protected Downloads add-on and XYZ Protect, here's how they work together:
| Feature | PMPro Protected Downloads | XYZ Protect |
|---------|--------------------------|-------------|
| What it protects | Downloadable files (PDFs, ZIPs) attached to Download posts | Images, videos, audio, documents embedded in page content |
| How files are stored | Moved to PMPro's restricted directory | Files stay in their original location |
| How files are served | Through a PHP handler with membership check | Through a Cloudflare Worker with cookie/encrypted URL check |
| Server configuration | Nginx requires manual rule; Apache auto-configured | None required — works on any server |
| Best for | Gated download buttons ("Click to download this PDF") | Inline media that renders on pages (gallery images, course videos, embedded documents) |
You don't need to choose one or the other. Use PMPro Protected Downloads for explicit file downloads and XYZ Protect for everything that renders inline on your member pages.
Please see https://support.xyzinc.com/blog/30-block-level-content-visibility-and-media-protection-pmpro for additional PMPro integration notes.
