How access is decided
The complete model, for courses and for lessons.
Opening a course
- Is login required, and is the visitor signed out? → blocked.
- Does the course have a permission rule? → the rule decides. Nothing else is consulted.
- Is the course marked as paid? → the student must have bought the associated product, in an order with a paid status. If that product is a subscription, the subscription must be active.
- Otherwise → open.
Opening a lesson
- Does the lesson have an attached course? → without one, the lesson does not resolve at all.
- Is login required on that course, and is the visitor signed out? → blocked.
- Does the lesson have its own permission rule? → it decides.
- Does the course have a permission rule? → it decides.
- Otherwise → the course's access decides, including the paid check.
And separately: a lesson marked as a preview is readable regardless, unless the course requires login for previews.
The three consequences worth memorising
A permission rule replaces the paid check. A course with both a rule and the paid toggle is decided by the rule alone. Choose one model.
A lesson rule replaces the course rule. It is not additive, so a lesson rule that is easier to satisfy widens access to that lesson.
The login requirement is checked first and cannot be widened. Enabling it can only reduce who gets in — which makes it a safe outer gate.
What each mechanism actually checks
| Mechanism | Checks |
|---|---|
| Login requirement | Only that someone is signed in |
| Permission rule | Role, purchases, subscription state, purchase or subscription dates |
| Paid course | A paid order containing the associated product, plus an active subscription if that product is one |
| Preview | Nothing — it is an exception |
Order statuses that count
For the paid-course check, orders that are pending, on hold, cancelled, refunded or failed do not grant access. Only orders in a paid status do.
That is how a refund removes access: when the order's status changes, the student stops matching.
Where progress fits
Progress is independent of access. It is recorded for signed-in students and calculated from all lessons attached to the course.
A student who loses access keeps their recorded progress; they simply cannot open the lessons.
What a blocked student sees
Never an error page:
| Situation | Shown |
|---|---|
| Course blocked | The course's Content if no access |
| Lesson blocked | The lesson's or the course's "Lesson not available" text |
| Login required, form enabled | Those messages plus a sign-in form |
Writing those texts is part of configuring access, not an afterthought. See The no-access experience.
Verify the model on your own site
Take one course and walk the tree:
- Signed out — course, then a lesson URL directly.
- Signed in without access — course, then a lesson, then a preview.
- Signed in with access — course, then a lesson.
If all six behave as the table above predicts, the course is configured correctly.