Build permission-restricted content
This recipe controls POM's presentation of a custom post type according to role, purchase, or subscription conditions. It is suitable when allowed visitors see the normal single template and others see a fallback or not-found result.
Permission rules do not change WordPress capabilities and do not protect REST responses, feeds, search, downloads, or third-party output automatically. Every additional exposure path needs its own access configuration.
Define the audience
Write the expected result for:
- a signed-out visitor;
- each allowed role;
- another signed-in role;
- a qualifying customer or subscriber;
- a signed-in customer who does not qualify.
Purchase and subscription conditions require their corresponding WooCommerce functionality and a signed-in account that can be evaluated.
Create the rule
- Go to Settings → POM Theme → Content model → Permission rules.
- Under Rules, choose Add permission rule.
- Enter a clear Rule name.
- Add a condition and choose its Rule type.
- Configure the required roles, products, purchase dates, or subscription values.
- Add further conditions only when necessary.
- Choose Condition between sub-rules:
- AND requires every condition;
- OR accepts any condition.
- Save the settings.
A rule without usable conditions does not restrict display.
Create the denied experience
Build a single fallback template that explains the available next action without revealing protected content. It can direct the visitor to sign in, purchase, subscribe, or return to public content.
Do not expose private titles, excerpts, downloads, prices, or membership facts merely to explain denial.
Assign the rule
- Open Settings → POM Theme → Content model → Post Types.
- Edit the protected post type.
- Select the saved Permission rule.
- Select Permission rule fallback template when a fallback is required.
- Save the settings.
Without a fallback, a failed rule produces a not-found single result.
Verify every branch
Use separate browser sessions and real test accounts for every audience state. Test the direct URL, archive, search, navigation, related content, APIs, feeds, files, and caches. The protected single presentation is only one part of the exposure review.