These abilities inspect and manage content restriction: checking who can see a post, restricting or opening up individual posts, and auditing everything that currently requires membership. They complement the site-wide rules described in the Access Control doc. See the Abilities API Overview for the full catalog.
check-content-access
members-only/check-content-access determines whether a user can view a given post under the current content-restriction rules, and tells you why. Use a user_id of 0 to check what a logged-out visitor sees.
Who can run it: users with the manage_options capability.
| Parameter | Type | Required | Description |
|---|---|---|---|
post_id | integer | Yes | The post to check access for |
user_id | integer | No | The user to check. Use 0 for a logged-out visitor. Defaults to 0. |
Returns: post_id, user_id, the allowed decision, and a machine-readable reason code such as user_is_member, membership_required, post_marked_public, post_not_found, post_not_readable, or post_password_required.
Password-protected posts always return allowed: false with the post_password_required reason, regardless of the user — even for members and administrators. WordPress post passwords are satisfied by a per-request cookie rather than by user identity, so a user_id alone can never prove access to a password-protected post.
set-post-restriction
members-only/set-post-restriction restricts or unrestricts a single post. It applies the same per-post override the editor metabox uses: for post types that are public by default it sets the “requires membership” override, and for post types that are restricted by default it sets the “available without membership” override. You just say whether the post should be restricted — the ability picks the right override.
Who can run it: anyone who can edit the specific post (the edit_post capability for that post) — so editors and authors can manage restriction on content they are allowed to edit, without needing site-admin rights.
| Parameter | Type | Required | Description |
|---|---|---|---|
post_id | integer | Yes | The post to update |
restricted | boolean | Yes | true to require membership to view the post; false to make it publicly available |
Returns: post_id, the resulting restricted state, the post_type_default (public or restricted), and the applied_meta_key that was written — useful for confirming exactly what changed.
Errors: members_only_post_not_found for an unknown post, and members_only_post_always_public for the site front page and the Members Only account page — those are always publicly available, so a restriction there would silently have no effect and is rejected instead.
list-restricted-content
members-only/list-restricted-content lists the posts that currently require membership, for auditing your gated content. When content restriction is disabled site-wide, it returns an empty list.
Who can run it: users with the manage_options capability.
| Parameter | Type | Required | Description |
|---|---|---|---|
post_type | string | No | Restrict results to this post type. Defaults to all public post types. |
limit | integer | No | Maximum posts to return, 1–100. Defaults to 20. |
offset | integer | No | Number of posts to skip, for pagination. Defaults to 0. |
Returns: count (posts in this page of results), total (all matching posts), limit, offset, and a posts array with each post’s ID, title, post type, status, and URL.
The audit accounts for both restriction models: posts of public-by-default types that carry an explicit “requires membership” override, and posts of restricted-by-default types that have not been marked available without membership. The front page and account page are excluded, since they are always public.