WordPress plugin client-lockbox-membership 1.0.2 · Author 007AJ · Works with any WordPress theme
This package is the Client Lockbox Membership plugin (client-lockbox-membership-1.0.2.zip). It works with any WordPress theme. Requirements: WordPress 6.3+ and PHP 7.4+. Upload the ZIP file as it is (do not unzip it).
client-lockbox-membership-1.0.2.zip and click Install Now.WP-CLI: wp plugin install client-lockbox-membership-1.0.2.zip --activate.
Updating: upload the new ZIP the same way and choose Replace current with uploaded. Member data and stored files are kept.
[clbm_portal]; files kept in the private storage folder (see Private file storage).[clbm_signals] / [clbm_signals_pnl]; optional Telegram/Discord.[clbm_downloads]; files kept in the private storage folder; per-level caps; optional buyer product keys.[clbm_signup level=""] — signup form; also available as the Membership signup block.[clbm_checkout level=""] — checkout form for a level (optional coupon code) that continues to Stripe hosted Checkout.[clbm_account] — the signed-in member's level, status, invoices and a button that opens the Stripe Customer Portal.[clbm_portal] — client portal.[clbm_signals limit="50" status=""] and [clbm_signals_pnl limit="100"] — signal history and P&L table.[clbm_downloads] — protected downloads list.Output uses your active theme's styles.
Use Stripe hosted Checkout only. Save the secret key and webhook signing secret under Settings. Card numbers never touch your WordPress server.
Webhooks are signature-checked, then each event is claimed as processing, handled, and marked processed only after it succeeded. If handling fails, the event is marked failed and the site answers with an error so Stripe retries it. A claim left by a crashed request expires after 5 minutes. Only successfully processed events are skipped as duplicates.
Portal and download files are never public media. They are delivered only through the plugin after a permission check (the signed-in owner or an administrator, or a valid signed link you created).
clbm-private-1a2b3c4d5e6f7a8b/) when that location is writable and not publicly served.wp-content/uploads/clbm-vault-…/) with .htaccess, web.config and index.php guards..htaccess), administrators see a persistent warning and a critical Site Health result with the exact rule to add. See Client Lockbox > Settings > Private file storage (with a Check again button).Nginx rule (use the folder name shown in your warning), then nginx -t && systemctl reload nginx:
location ^~ /wp-content/uploads/clbm-vault-xxxxxxxxxxxxxxxxxxxxxxxx/ {
deny all;
}To choose the folder yourself, add define( 'CLBM_STORAGE_DIR', '/full/path/outside/web/root/clbm-files' ); to wp-config.php. CLBM_PORTAL_DIR and CLBM_DOWNLOADS_DIR still set each area separately.
Open Client Lockbox > Starter sites to import one of five page sets: client portal, signals club, download club, course and community. Import one starter at a time. Pages are built from core WordPress blocks and take their look from your active theme. Rollback removes pages/menu created by that import and restores the previous front-page settings. Levels added by a starter are kept (additive).
By default, with no payment or chat credentials saved, this plugin does not call outside hosts. When an administrator saves Stripe credentials, the site contacts Stripe for hosted Checkout, the Stripe Customer Portal and inbound webhooks. Card details are entered on Stripe's pages and never reach your site. Telegram (api.telegram.org) and Discord (discord.com webhooks) are contacted only when Signals push is enabled with your own bot token or webhook. The storage self-test makes one HTTP request from your site to its own address (never to another host) to confirm private files cannot be downloaded directly. Nothing is sent to 007aj.com for product unlock checks. This plugin has no License tab and does not gate features behind a product key.
Client Lockbox Membership stores membership levels, member–level associations, order and invoice records (amounts, currency, status, payment-provider references — never card numbers), content-restriction and drip settings, email template settings, report aggregates, and (if you use those modules) portal file metadata, signal posts you create, download logs, and optional license keys you issue for your downloadable products, in your site's database. Portal and download file bytes are stored in a private folder outside the web root when the server allows it (otherwise in a randomly named folder inside uploads that the plugin tests for direct access) and are delivered only through the plugin after a permission check. The plugin sets no marketing cookies. It does not claim to make your site HIPAA- or GDPR-compliant; you remain responsible for your own policies, lawful basis and server security. When you delete the plugin, nothing is removed unless you tick "Delete all plugin data on uninstall" first.
Yes. By default they are stored outside the web root, so there is no URL to download them from. If your host only allows the uploads fallback, the self-test detects direct access and shows the exact Nginx rule to add until the files are blocked.
No. Each use is counted with one atomic database update that only succeeds while uses remain, so parallel requests cannot exceed the limit. Per-member download caps are enforced the same way.
The event is marked failed and the site returns an error, so Stripe retries it. It is treated as a duplicate only after it was processed successfully.
No. All included features work when the plugin is active. There is no License tab or activation screen.
Purchase includes 6 months of support. Use continues on 1 domain after support ends. Sold on WPBay and 007aj.com only. Contact admin@007aj.com.