Title: s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Author: Cristián Lávaque
Published: 22 Tháng 3, 2010
Last modified: 29 Tháng 8, 2026
---
Tìm kiếm plugin
# s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions
Bởi [Cristián Lávaque](https://profiles.wordpress.org/clavaque/)
[Tải về](https://downloads.wordpress.org/plugin/s2member.260829.zip)
* [Chi tiết](https://vi.wordpress.org/plugins/s2member/#description)
* [Đánh giá](https://vi.wordpress.org/plugins/s2member/#reviews)
* [Cài đặt](https://vi.wordpress.org/plugins/s2member/#installation)
* [Nhà phát triển](https://vi.wordpress.org/plugins/s2member/#developers)
[Hỗ trợ](https://wordpress.org/support/plugin/s2member/)
## Mô tả
❤️ **Excellent membership plugin!** Over 15 years of experience, development, releases…
Still going and growing!
**Start your membership profits!** Build your tribe, gather your followers, enroll
your students, bring in your clients!
💵 Enjoy the benefits of getting paid repeatedly for access to your site!
⭐⭐⭐⭐⭐ _**Brilliant** “So glad I found this. It works brilliantly for our needs…
love the seamless integration with PayPal. Everything we need. Thank you so much
for creating this!” –[zarverk2000](https://wordpress.org/support/topic/brilliant-1268/)_
#### The best way to make money from your WordPress site!
🤩 Sell **unlimited memberships**, turn free subscribers into members (_subscriber
to member s. 2 member s2Member_), with a single payment or recurring payments
subscriptions.
**Easy and quick to use.** Protect your membership content in a moment, and a moment
later be ready to get payments for member access!
**Easy to configure and very flexible.** Protect the whole site, nothing, or just
parts, even member files for paid downloads!
👉 Install s2Member now and **make money!** 😀
⭐⭐⭐⭐⭐ _**So much capacity & great support** “I’m a novice and was able to quickly
figure it out. When I got stuck I go to the support forum and Cristian is there
with a quick answer to get me going again.” –[blueruck](https://wordpress.org/support/topic/so-much-capacity-great-support/)_
⭐⭐⭐⭐⭐ _**The very best plugin and support service** “Great plugin, neat, easy
to configure, and with interesting security features. A special mention to Cristian
whose support is awesome, fast, clear even to free members like myself” –[aflorarte](https://wordpress.org/support/topic/the-very-best-plugin-and-support-service/)_
**Packed with features**, but not required to use them all, just those you want.
Some of them:
➡️ Member user levels and custom access capabilities
➡️ Membership content protection(
post, page, category, tag, etc) ➡️ Protect anything served by WP (post types, URLs)
➡️ Member file protection (sell downloads) ➡️ Prevent member account sharing (limit
IPs, simultaneous logins) ➡️ Protect accounts (limit failed login attempts) ➡️ Cool
security/trust badge with your domain ➡️ PayPal Standard buttons for membership
payments (more in Pro) ➡️ Automatic member access demotion at end of paid access
time ➡️ Tracking software integration (affiliates, etc) ➡️ Email list services (
Mailchimp, etc) ➡️ Notifications (signups, payments, etc) ➡️ Integrate with bbPress,
BuddyPress for member communities ➡️ Compatible with any well coded theme (Elementor,
Divi, etc) ➡️ Customize the WP login/registration look ➡️ Custom redirection after
member login ➡️ Create custom profile fields for member accounts ➡️ Customize the
user welcome email ➡️ And more!
👉 Install and start using s2Member now! 🤩
⭐⭐⭐⭐⭐ _**Very Powerful Membership Plugin** “This membership plugin does a lot
and has many, many configuration options to achieve whatever you want… I received
extremely quick and reliable support.” –[liltrucks](https://wordpress.org/support/topic/very-powerful-membership-plugin/)_
⭐⭐⭐⭐⭐ _**Simple, Compatible, Secure, and Versatile!** “We are seriously impressed
with this plugin and we highly recommend it… We have not found ANY limitations to
what we are trying to accomplish… a very smooth process… straight-forward and user-
friendly!… exceeded our expectations!” –[tips4gamers](https://wordpress.org/support/topic/simple-compatible-secure-and-versatile/)_
⭐⭐⭐⭐⭐ _**Excellent plugin** “This plugin does everything it says on the box.
It does it well… the functionality is absolutely spot on. The developers/maintainers
are also active and helpful. Totally recommended!” –[richardfoley](https://wordpress.org/support/topic/excellent-plugin-5188/)_
⭐⭐⭐⭐⭐ _**Best Membership Plugin I’ve Used** “I switched to s2 Member around
3 years ago after trying a few plugins. I found these other plugins inflexible and
difficult to configure… Well worth investigating if you want a robust membership
solution.” –[rnwhalley](https://wordpress.org/support/topic/best-membership-plugin-ive-used/)_
🤖 Not needed to know any PHP code or be a developer. Only code needed is copy-paste
wp shortcodes, like for the paypal buttons… But is also developer-friendly to customize
your installation if wanted.
#### Some reasons to get s2Member Pro
✅ Membership content dripping
✅ Stripe, PayPal Pro, Authorize.Net, ClickBank
✅ On-site one-step checkout with pro-forms (Stripe, PayPal, Auth.Net) ✅ Unlimited
membership levels ✅ Membership renewal reminder emails ✅ Single-step member registration
and payment with pro-forms ✅ Custom redirection after payment ✅ Coupon codes and
gift/redemption codes ✅ Custom member offer redirections after login ✅ Pro API
for new integrations ✅ Public members directory ✅ Members bulk import/update/exporter
✅ Multisite network support ✅ Login and registration forms to use in pages/posts
👉 [Click here for more](https://s2member.com/features/) 🙂
⭐⭐⭐⭐⭐ _**The Best Membership Plugin** “I have built with most Membership plugins
and literally dozens using S2 Pro and I can tell you, bar none it is the best of
all of them. Extremely powerful, anything you might want to do it can do… I highly
recommend you try it out.” –[antwoords](https://wordpress.org/support/topic/the-best-membership-plugin-5/)_
⭐⭐⭐⭐⭐ _**Excellent plugin & top support** “We’ve used s2member pro on a few
projects now & find it has met all our membership needs. Most impressive has been
the support. Excellent communication, knowledgeable, friendly and super patient
🙂” –[aaee6](https://wordpress.org/support/topic/excellent-plugin-top-support-3/)_
⭐⭐⭐⭐⭐ _**Awesome Support** “I’ve been using s2Member for 9 years… Amazing support
of a high-end plugin and much appreciated. This is one of the reasons I stick with
s2Member. Support has always been great!” –[graphichome](https://wordpress.org/support/topic/awesome-support-712/)_
⭐⭐⭐⭐⭐ _**Wonderful Support** “Above and beyond. I’ve used this plugin for over
ten years with various clients and whenever I need help, they’ve helped find a solution.”–
[germars](https://wordpress.org/support/topic/wonderful-support-68/)_
The free s2Member Framework integrates with PayPal Website Payments Standard (also
free). Sell “Buy Now” or Membership access to your site. Restrict access to Roles,
Capabilities, Posts, Pages, or anything else in WordPress.
Protect your WordPress Posts, Pages, Tags, Categories, URIs, BuddyPress, bbPress,
and even portions of content within Posts, Pages, themes, plugins. **Easily configurable
and highly extensible.** You can even protect downloadable files and streaming audio/
video. Store files locally, or use s2Member’s integration with Amazon S3/CloudFront.
s2Member is powered almost entirely by WordPress shortcodes, making advanced integrations
quick and easy. Sell recurring (or non-recurring) subscriptions with lots of flexibility.
Or sell “Buy Now” membership access in various ways. You can also sell specific
Posts/Pages, sell member access to file downloads, or sell members Custom Capabilities
that provide highly configurable access to specific portions of your content.
👉 Install now s2Member and **start making money!** 😀
## Ảnh màn hình
[⌊s2Member Screenshot #1⌉⌊s2Member Screenshot #1⌉[
s2Member Screenshot #1
[⌊s2Member Screenshot #2⌉⌊s2Member Screenshot #2⌉[
s2Member Screenshot #2
[⌊s2Member Screenshot #3⌉⌊s2Member Screenshot #3⌉[
s2Member Screenshot #3
[⌊s2Member Screenshot #4⌉⌊s2Member Screenshot #4⌉[
s2Member Screenshot #4
[⌊s2Member Screenshot #5⌉⌊s2Member Screenshot #5⌉[
s2Member Screenshot #5
[⌊s2Member Screenshot #6⌉⌊s2Member Screenshot #6⌉[
s2Member Screenshot #6
[⌊s2Member Screenshot #7⌉⌊s2Member Screenshot #7⌉[
s2Member Screenshot #7
## Cài đặt
**NOTICE:** For help with s2Member Pro, please use [our forum](http://s2member.com/r/forum/).
#### s2Member is very easy to install
Just like any other normal plugin:
* From the WP Admin’s [Plugins Add New Screen](https://wordpress.org/support/article/plugins-add-new-screen/).
* Or via FTP upload the `s2member` folder from the zip to your `/wp-content/plugins/`
directory.
* Activate it from **Plugins** page in your WordPress Admin.
Here’s a [quick-start video](https://www.youtube.com/watch?v=qlKn-I-0W6U) for a
simple basic setup to get you started.
#### See also
[Detailed installation/upgrade instructions](http://s2member.com/installation/).
#### Is s2Member compatible with Multisite Networking?
Yes, requires s2Member Pro for Unlimited Sites. After you enable Multisite Networking,
with s2Member Framework and Pro active, navigate to `s2Member → Multisite (Config)`
in the Dashboard on your Main Site.
## Hỏi đáp
**NOTICE:** For help with s2Member Pro, please use [our forum](http://s2member.com/r/forum/).
### Is s2Member compatible with Multisite Networking?
Yes, s2Member Pro for Unlimited Sites is compatible with Multisite Networking. After
you enable Multisite Networking, with s2Member Framework and Pro enabled, navigate
to `s2Member → Multisite (Config)` in the Dashboard on your Main Site.
### Where can I find more information?
* s2Member FAQs: [http://s2member.com/faqs/](http://s2member.com/faqs/)
* Knowledge Base: [http://s2member.com/kb/](http://s2member.com/kb/)
* Video Tutorials: [http://s2member.com/videos/](http://s2member.com/videos/)
* Community: [http://s2member.com/r/forum/](http://s2member.com/r/forum/)
* Codex: [http://s2member.com/codex/](http://s2member.com/codex/)
### Translating s2Member
Please see: [http://s2member.com/r/translations/](http://s2member.com/r/translations/)
## Đánh giá
### [True professional](https://wordpress.org/support/topic/true-professional/)
[belindaj](https://profiles.wordpress.org/belindaj/) 17 Tháng 4, 2026 1 trả lời
I need a lot more than 5 stars to properly review s2member. I took on a project
from a previous web host and it has been my first and so far only experience with
this member plugin. Just from lack of personal experience I was tempted to try to
rebuild the existing user system using other plugins and apps that I had more knowledge
of – but at the same time it housed a large existing member database and I wanted
to try to work within the existing framework if possible. I was having a lot of
trouble accomplishing what I needed to work and asked for assistance through s2
support and I am so impressed with the level of professionalism, prompt response,
ease of understanding the needs I had, and basically – meeting me on my level. I
really cannot express enough appreciation for this level of support. I feel like
Cristián is now a true colleague that I can continue to bring issues to and maybe
in some small way I’ll even contribute to future s2member enhancements to this already
extremely powerful member plugin.
### [Support in 2026 is still great](https://wordpress.org/support/topic/support-in-2026-is-still-great/)
[leoravera](https://profiles.wordpress.org/leoravera/) 22 Tháng 3, 2026 1 trả lời
The plugin is still working very well, you can do almost anything, especially using
shorcodes and the “if” function. Cristian is actively working on the plugin, and
provides a great support. Other plugins I used have become more expensive and the
support is a nightmare, while is so easy to get in touch with Cristián Lávaque.
5 star for me, I’m happy I discovered this plugin many years ago and that it’s still
supported and woking very well!
### [Absolutely fantastic support](https://wordpress.org/support/topic/absolutely-fantastic-support-6/)
[paul16f1](https://profiles.wordpress.org/paul16f1/) 21 Tháng 2, 2026 1 trả lời
Cristian got back to me super quick and resolved my problem.Unusual to have such
great customer service.It is a great plugin and so versatile.thanks Cristian
### [This plugin and support are awesome](https://wordpress.org/support/topic/this-plugin-and-support-are-awesome/)
[kemmieg](https://profiles.wordpress.org/kemmieg/) 22 Tháng 10, 2025 1 trả lời
I have been using this plugin for a couple of my websites and it’s a great plugin.
The support for this plugin is A1. They have been more than helpful in getting me
pointed in the right direction and getting my issues resolved in a timely manner.
I would recommend this plugin to anyone looking for a very robust membership plugin.
### [Great product, great support!](https://wordpress.org/support/topic/great-product-great-support-219/)
[diegomane](https://profiles.wordpress.org/diegomane/) 12 Tháng 8, 2025 1 trả lời
Highly recommended!
### [Quick response, very helpful](https://wordpress.org/support/topic/quicky-response-very-helpful/)
[ollyw](https://profiles.wordpress.org/ollyw/) 10 Tháng 8, 2025 1 trả lời
Had an issue where s2member PayPal buttons were causing a strange intermittent error.
Cristian responded promptly to my s2member Pro support request and with his help
we sorted the problem. Very grateful :).
[ Đọc tất cả 234 đánh giá ](https://wordpress.org/support/plugin/s2member/reviews/)
## Người đóng góp & Lập trình viên
“s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls&
Member Access Subscriptions” là mã nguồn mở. Những người sau đã đóng góp vào plugin
này.
Những người đóng góp
* [ Cristián Lávaque ](https://profiles.wordpress.org/clavaque/)
* [ WebSharks ](https://profiles.wordpress.org/websharks/)
* [ JasWSInc ](https://profiles.wordpress.org/jaswsinc/)
* [ Raam Dev ](https://profiles.wordpress.org/raamdev/)
* [ Eduardo Lavaque ](https://profiles.wordpress.org/eduan/)
“s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls&
Member Access Subscriptions” đã được dịch qua 2 ngôn ngữ. Cảm ơn [những người tham gia dịch](https://translate.wordpress.org/projects/wp-plugins/s2member/contributors)
vì đóng góp của họ.
[Dịch “s2Member – Excellent for All Kinds of Memberships, Content Restriction Paywalls & Member Access Subscriptions” sang ngôn ngữ của bạn.](https://translate.wordpress.org/projects/wp-plugins/s2member)
### Muốn tham gia phát triển?
[Duyệt code](https://plugins.trac.wordpress.org/browser/s2member/), check out [SVN repository](https://plugins.svn.wordpress.org/s2member/),
hoặc theo dõi [nhật ký phát triển](https://plugins.trac.wordpress.org/log/s2member/)
qua [RSS](https://plugins.trac.wordpress.org/log/s2member/?limit=100&mode=stop_on_copy&format=rss).
## Nhật ký thay đổi
#### v260829
* (Framework) **Major Improvement:** Rebuilt the Automatic End-of-Term processing
engine so membership expirations are handled more reliably and promptly when
due, even on busy sites or after delays, while making the system safer to administer
and easier to review and troubleshoot.
- **Faster, adaptive processing:** Instead of stopping after 6 users, the new
engine uses the safe processing time available in each run and adapts to current
speed, allowing it to handle hundreds of users in one pass.
- **Rapid queue catch-up:** s2Member processes each member as promptly as practical
after their actual EOT time is reached. If work remains, it continues about
a minute later instead of waiting for the next regular 10-minute check. In
our stress testing, a 1,000-user queue was processed in under 2 minutes, while
the old 6-user limit would take almost 28 hours.
- **More resilient processing:** Overlapping runs are prevented, interrupted
or stale runs recover cleanly, and unfinished work remains available for the
next pass instead of being lost or unnecessarily delayed.
- **Safer “Delete” behavior and review:** Automatic Delete now removes membership
access and moves the user account to Pending Deletion instead of permanently
deleting it, preserving useful payment/subscription details for review before
single/bulk deletion. Irreversible automatic deletion can still be enabled
with the `ws_plugin__s2member_allow_eot_user_deletion` filter. _WP Admin >
Users > Pending Deletion_
- **New End-of-Term user lists:** Added separate Current and Previous lists
with EOT Time, Last EOT, and EOT Demotion columns. Current shows users with
an EOT, earliest first; Previous shows prior EOTs, most recent demotion first.
Older demotion times are recovered from Administrative Notes where possible.
_WP Admin > Users > End-of-Term Current / End-of-Term Previous_
- **Better demotion history:** EOT actions, including moves to Pending Deletion,
now leave more useful Administrative Notes with the role change, removed Custom
Capabilities, subscription details, and the EOT that triggered the action.
For example: _2026-08-31 00:03 EDT s2Member: Demoted from Level 1 to Subscriber(
removed ccaps: courses). PayPal I-ABC123. EOT 2026-08-31 00:01 EDT._
- **Visible health and automatic recovery:** A new Automatic Behavior Status
shows pending and overdue EOTs, recent processing activity, the next scheduled
run, and the current processing runtime, making delays and other problems
visible instead of silent. s2Member repairs a missing WP-Cron schedule automatically
when possible, and alerts administrators when a problem persists and needs
attention.
* (Pro) **Major Improvement:** Rebuilt the End-of-Term Reminder Email processing
engine so renewal notices have a better chance of going out promptly on their
intended day, even after WP-Cron delays or temporary email sending problems that
could previously prevent them from being sent.
- **Fast, adaptive processing:** The new engine replaces the old 6-member limit
with safe runtime-based processing, prevents overlapping runs, recovers interrupted
ones, and continues about a minute later when more work remains. On our test
server, 1,000 reminders were handed off through WordPress’s mail system in
about 42 minutes, while the old engine would need almost 28 hours.
- **Independent reminder engine:** Reminders based on stored End-of-Term dates
now have their own schedule and processing engine, so they no longer depend
on membership-expiration processing completing first and aren’t held up by
a large or stalled End-of-Term queue.
- **Forgiving timing and smart retries:** Reminder eligibility now uses calendar
days, giving s2Member opportunities throughout the intended send day plus
an extra recovery day in case of delays. Failed sends are retried after about
10 minutes, 30 minutes, 1 hour, and then every 3 hours while still eligible,
with each recipient tracked independently to avoid duplicate resends.
- **Visible health and automatic recovery:** A new End-of-Term Reminder Status
shows scheduling activity, recent successful delivery, and recipients currently
being retried, with additional failure and recovery details when something
goes wrong. s2Member repairs a missing reminder schedule when possible, retries
failed recipients automatically, and alerts administrators when problems persist
and need attention.
* (Framework & Pro) **Fix:** Fixed the long-standing issue where the Automatic
End-of-Term setting could appear blank when its WP-Cron event was missing. The
saved setting now remains visible while s2Member reports and repairs the scheduling
problem separately.
* (Pro) **Fix:** End-of-Term renewal reminders are no longer sent when membership
access ended because of a refund, payment reversal, or chargeback. These payment
exceptions are now distinguished from normal membership expirations so they don’t
trigger inappropriate renewal notices.
* (Pro) **Enhancement:** Modernized s2Member Pro-Forms with PayPal Checkout, using
PayPal’s current REST APIs and Smart Payment Buttons for off-site payments. When
PayPal Checkout is enabled in s2Member, it replaces the legacy PayPal Express
Checkout integration for payments completed on PayPal’s site. Existing Pro-Form
shortcodes work as-is (no edits required). Enable it under _WP Admin > s2Member
> PayPal Options > PayPal Checkout (Beta)_.
* (Framework) **Improvement:** Strengthened PayPal Checkout REST order validation,
capture reliability, retry handling, and payment processing safeguards.
* (Framework) **Improvement:** Better PayPal Checkout button feedback with clearer,
more visible error and status messages below the button.
* (Framework) **Improvement:** Better compatibility for sites using PayPal Checkout
while older PayPal subscriptions remain active. Since PayPal subscriptions generally
need the integration that created them, s2Member now uses the appropriate one
for next payment dates, reminder emails, `[s2EOT]`, and cancellations.
* (Framework) **Security:** Strengthened PayPal Checkout return validation and
payment-flow integrity.
* (Framework) **Fix:** Improved PayPal Checkout subscription fulfillment retry
handling, preventing failed payment notifications from being incorrectly marked
complete and allowing browser or webhook recovery to retry safely.
* (Framework) **Fix:** PayPal Checkout now registers all required webhook events.
Existing configured webhooks are updated automatically after upgrading, adding
notifications for subscription activation/updates, payment refunds/reversals,
and disputes/chargebacks.
* (Pro) **Fix:** Strengthened Stripe Pro-Forms against duplicate charges from concurrent
or repeated submissions of the same rendered checkout. Stripe requests now use
a stable per-checkout idempotency ID, simultaneous submissions are blocked while
payment processing is in progress, and a failed update to an existing PaymentIntent
no longer falls through to creating another one. Thanks to DrCheap for the detailed
report and investigation. See [thread 13589](https://f.wpsharks.com/t/13589).
* (Pro) **Fix:** Fixed a Stripe compatibility issue that could cause `[s2Member-
Profile /]` and Stripe billing-update forms to crash when retrieving an existing
subscription with newer Stripe API responses/SDK behavior. Thanks to Tim Hibberd
for reporting it and providing a patch. See [thread 13575](https://f.wpsharks.com/t/13575).
* (Pro) **UI:** Updated Stripe Webhook/IPN setup guidance to list all seven events
s2Member handles. Sites with an existing Stripe webhook configured for selected
events should make sure all seven are selected, including `charge.dispute.created`,
so disputes/chargebacks can follow the configured Reversals/Disputes EOT behavior.
* (Pro) **Improvement:** Added an optional `placeholder` attribute for Authorize.
Net, PayPal, and Stripe Pro-Form Checkout Options. This allows a Pro-Form to
start with a non-payable prompt instead of automatically selecting the first
Checkout Option, requiring the customer to choose a real option before the full
checkout form is shown.
* (Framework & Pro) **Fix:** Improved shortcode attribute handling when editors
replace straight quotes with smart/curly quotes. s2Member now also normalizes
literal smart quotes so values such as `attribute=“0”` are interpreted correctly.
Thanks to Vincent for reporting it. See [thread 13572](https://f.wpsharks.com/t/13572).
* (Framework) **Enhancement:** Added a hook after profile modifications are saved
and s2Member refreshes the user data, allowing integrations to read freshly updated
user and custom profile fields. Thanks to Craig for bringing attention to this
use case. See [thread 13515](https://f.wpsharks.com/t/13515).
* (Framework & Pro) **Improvement:** Bumped PHP version compatibility up to PHP
8.5.9 after addressing the remaining deprecation notices and related compatibility
issues, while maintaining support for older PHP versions.
* (Framework) **Fix:** Hardened PayPal recurring-payment handling for missing optional
IPN fields and memberships without Custom Capabilities, preventing PHP warnings
and deprecation notices.
* (Framework) **Fix:** Hardened gateway notification and return handlers against
missing or null optional transaction fields, preventing PHP warnings and deprecation
notices.
* (Framework) **Fix:** Prevented PHP warnings during registrations or membership
updates when optional details (like Custom Capabilities or EOT) weren’t used.
* (Framework) **Fix:** Corrected an edge case in subscription modifications where
an optional EOT component could end up in the Custom Capabilities value.
* (Framework) **Fix:** Fixed PHP 8 compatibility issues in legacy OpenSSL/RSA signing
and the Markdown fallback that could fail in some cases.
#### v260814
* (Framework) **Improvement:** Better s2Member Security Encryption Key handling
and related guidance in the admin panel.
* (Framework) **Improvement:** Hardened input validation and sanitization for the`
s2Key`, `s2File`, `s2Stream`, and `s2Member-PayPal-Button` shortcodes.
* (Framework & Pro) **Improvement:** Renamed and expanded the `s2Get` shortcode’s
user-field whitelist into the shared _Shortcode User Fields Whitelist_ setting,
now used for `s2Get`‘s `user_id` attribute and `s2Member-List`‘s `show_fields`
attribute. Administrators are warned when either shortcode attempts to display
an un-whitelisted field’s value that doesn’t belong to the current user viewing
the page.
* (Framework & Pro) **Security:** Improved validation and hardened handling of
serialized data throughout s2Member.
* (Pro) **Improvement:** Hardened input validation and sanitization for the `s2Member-
Login`, `s2Member-Summary`, `s2Member-Gift-Codes`, `s2Member-List`, `s2Member-
List-Search-Box`, and `s2Member-Pro-ClickBank-Button` shortcodes, as well as
the Pro Login Widget.
* (Pro) **Security:** Added stricter handling for `s2Member-List`‘s `show_fields`
attribute. s2Member will warn administrators about detected fields that still
need review. Fields not whitelisted will not be displayed. Sites using `show_fields`
should review _General Options > Shortcode User Fields Whitelist_ and allow the
fields their Member Lists are intended to display.
* (Pro) **Security:** Added safer handling and a whitelist for the `template` shortcode
attribute, used by the `s2Member-List`, `s2Member-List-Search-Box`, and Stripe,
PayPal, and Authorize.Net Pro-Forms shortcodes. s2Member will warn administrators
about detected templates that still need review. Templates not whitelisted will
not be used, and the standard template will be used instead. Sites using custom
templates should review _General Options > Pro Shortcode Templates Whitelist_
and allow their custom template files.
* (Pro) **Fix:** Prevented the Pro updater from offering or installing a Pro release
newer than the installed s2Member Framework, avoiding compatibility issues until
the Framework is updated first.
* (Pro) **Fix:** Prevented Stripe payment processing from continuing after Pro-
Form validation rejects a submission, avoiding misleading Stripe card-field errors
when other required form fields are missing.
* (Pro) **Fix:** Updated Stripe Pro-Forms to use the shortcode’s `validate_zipcode`
attribute correctly, so it can override the default setting to collect and validate
the card’s postal code.
#### v260805
* (Framework) **Improvement:** Replaced TinyURL-based shortening for generated
Registration Access and Specific Post/Page Access URLs with new built-in s2Member
short links, stored temporarily with WordPress transients. Existing TinyURL settings
now use the built-in shortener automatically, avoiding TinyURL’s deprecated no-
key API endpoint and extra third-party pages shown before the destination.
* (Framework) **Improvement:** Better PayPal Checkout cancellation button handling
when stored IPN Signup Vars are missing. s2Member now checks PayPal subscription
details via API before cancellation, uses PayPal’s next billing time plus the
configured EOT grace period for the EOT time, and falls back to PayPal’s subscription
management page when a safe local cancellation cannot be completed. See [thread 13462](https://f.wpsharks.com/t/13462).
* (Framework) **Security:** Hardened the `[s2Stream]` shortcode against executable
JavaScript injection by users with post-editing privileges. Attributes used to
configure JW Player are sanitized and validated more strictly, and custom `player_path`
values must now be explicitly whitelisted using the `ws_plugin__s2member_sc_get_stream_player_paths`
filter.
* (Framework) **Security:** Improved sanitization of sensitive data in s2Member
debug logs.
* (Framework) **Fix:** Prevented a PHP 8+ fatal error during PayPal Standard PDT/
IPN return handling when PayPal reports an invalid or unexpected charset. PayPal
return data is now converted to UTF-8 defensively, with fallback handling when
the reported charset is not accepted by `mb_convert_encoding()`.
* (Pro) **Improvement:** Added safer handling for rare Stripe Pro-Form subscription
checkouts where the first payment or setup confirmation remains pending. s2Member
now delays paid-access changes until Stripe confirms the subscription is ready,
helping avoid premature access while reducing the chance of confirmed Stripe
subscriptions not matching s2Member access.
* (Pro) **Fix:** Fixed validation of zero-like trial period values such as `tp="
0.00"`, so they are treated the same as `tp="0"` instead of being rejected as
an invalid trial period.
#### v260508
* (Framework) **Fix:** PayPal Checkout cancellation shortcodes now keep `output
="anchor"` clickable for logged-out visitors. Only `output="button"` requires
the member to be logged in. See [thread 13450](https://f.wpsharks.com/t/13450)
* (Framework) **Fix:** PayPal Checkout no longer aborts if the customer’s IP address
changes during checkout. IP mismatches are logged, but valid checkouts continue
processing.
* (Framework) **Fix:** Prevent false Auto-EOT demotions when a stored Auto-EOT
time is `0`, and improve logging for invalid Auto-EOT values. See [thread 13412](https://f.wpsharks.com/t/13412)
* (Framework) **Fix:** Prevented a PHP 8.1+ deprecation notice while reading registration
times when the stored value is missing or false.
* (Framework) **Improvement:** Improved PayPal Checkout button loading with a client-
side fallback when the PayPal SDK is missing from the final page output.
* (Pro) **Fix:** Prevented deprecation notices on newer PHP versions, which could
interfere with automatic login/redirects after Stripe checkout.
* (Pro) **UI:** Improved cancellation pro-form submit button text. Cancellation
forms now say “Cancel Subscription” instead of the generic “Submit Form”. See
[thread 13438](https://f.wpsharks.com/t/13438)
#### v260410
* (Framework) **Fix:** Reduced the upfront requirements for processing PayPal Standard`
subscr_cancel` IPNs so valid cancellations are not ignored when supporting values
are missing, stale, or non-membership-specific.
* (Framework) **Fix:** Prevent incorrect s2Member notifications in some PayPal
Checkout cases where several webhooks are received about the same subscription.
* (Framework) **Fix:** Prevent duplicate processing and notifications when PayPal
sends both a webhook and an IPN for the same PayPal Checkout subscription payment.
* (Framework) **Fix:** Added subscription modification cancellation support to
the Framework, which was previously only available in the Pro addon.
* (Pro) **Fix:** Made subscription modification cancellation gateway-aware, preventing
orphaned active subscriptions when a member starts a replacement subscription
through a different gateway.
* (Pro) **Fix:** Prevented rare cases where subscription modification processing
could cancel the newly created subscription by mistake.
* (Pro) **Fix:** Improved Stripe customer lookup during checkout retries by falling
back to email when the stored Stripe customer ID is missing, stale, or no longer
retrievable.
#### v260325
* (Framework) **Fix:** Improved PayPal Checkout webhook idempotency to prevent
duplicate processing during repeated/concurrent webhooks, while preserving normal
behavior.
* (Framework) **Fix:** Resolved a PayPal IPN issue where some `subscr_cancel` notifications
were ignored because the cancellation handler failed before it had fully identified
the recurring subscription.
* (Framework) **Improvement:** Added IPN Signup Var lookups for missing PayPal
cancellation IPN values like `period1`, `period3`, `item_number`, `item_name`,
and `payer_email`, preventing valid `subscr_cancel` notifications from being
ignored.
* (Framework) **Improvement:** Moved s2Member’s translation files to `/languages`,
following the WordPress standard, and updated `.mo` loading to support that directory
while continuing to support the standard and legacy WordPress locations.
* (Framework) **Improvement:** Hardened PayPal Standard IPN endpoint response handling
and added debug logging for hosts/security layers that incorrectly return HTTP
403 after successful processing.
* (Framework) **Enhancement:** Added `ukpostcode` as an expected-value option for
Custom Registration/Profile Fields, with matching server-side and client-side
validation for UK postcode input. The validation is designed to be reasonably
broad, including standard UK formats and related special cases. Thanks to Gerard
Earley for contributing the patch. See [thread 12200](https://f.wpsharks.com/t/12200)
* (Framework) **Enhancement:** Added a new **General Options > s2Get Shortcode**
setting to allow `user_id` for whitelisted user fields, defaulting to current-
user. Also updated the s2Get KB article accordingly.
* (Pro) **Fix:** Updated Stripe card charge and PaymentIntent requests to use `
statement_descriptor_suffix` instead of `statement_descriptor`, fixing card-payment
errors where Stripe no longer accepts `statement_descriptor` for card payments.
* (Pro) **Fix:** Corrected Stripe subscription checkout so resumed PaymentIntent
flows no longer go through the wrong intent-status handler.
* (Pro) **Fix:** Stripe now stops cleanly after card declines, instead of continuing
into secondary intent/payment-method errors.
* (Pro) **Fix:** Improved Stripe recurring-payment setup to better support future-
charge authorization requirements, fixing failures in countries with stricter
payment rules, including India.
* (Pro) **Fix:** Stripe now updates recurring default payment methods only after
a successful intent result, instead of earlier in checkout.
* (Pro) **Fix:** Billing-update SetupIntent creation failures in Stripe now return
the proper error response.
* (Pro) **Fix:** Prevent duplicate/retried Stripe webhook events from being processed
more than once, including near-simultaneous retries of the same Stripe event
ID
* (Pro) **Fix:** prevent Stripe billing modification/replacement from triggering
EOT behavior for the cancelled old subscription while s2Member is still updating
the member account with the new subscription.
* (Pro) **Fix:** Removed a trailing-comma syntax issue in Stripe subscription update
code that could cause PHP compatibility errors on older supported PHP versions.
* (Pro) **Fix:** s2Member now cleans up incomplete subscriptions left behind by
failed 3D Secure authentication attempts during Stripe checkout, and gives the
customer a more clear payment failure message.
* (Pro) **Improvement:** Added dedicated s2 Stripe log entries for non-fatal failures
while updating the default payment method after successful intent completion.
#### v260312
* (Framework) **Fix:** Prevent a PHP 8.1+ deprecation notice from appearing above
the admin Users table in some cases.
* (Framework) **Security:** Improved debug log sanitization.
* (Framework) **Improvement:** PayPal Checkout credential test and OAuth failure
log entries now include client_len_hash / secret_len_hash values (length_hash,
e.g. 80_4d9a7c1b2e8f4a21) to help compare attempted credentials during troubleshooting
without exposing raw values.
* (Framework) **Enhancement:** Added a new _No-Cache Headers Behavior_ option under
_General Options > Performance & Caching_, making no-cache behavior configurable
from the admin UI. It includes:
- `Always` mode, the legacy safe default that prevents caching site-wide in
case user-conditional output appears.
- `Selective` mode, which was previously available only through a filter and
may improve caching for guests, but can miss some runtime no-cache triggers.
- The new `Evaluative` beta mode, which evaluates the page with more runtime
information and may allow more pages to be cached safely for guests.
- An optional debug header to help troubleshoot no-cache behavior.
* (Framework) **UI:** Clarified the Download Options text to explain that unique
download limits are counted in the last X days (rolling window), reducing confusion
about whether the limit resets on fixed calendar dates.
* (Framework) **UI**: Improved the PayPal Checkout credentials test failure message.
* (Framework) **UI:** Fixed the PayPal button encryption admin notice so that it
shows only to administrators in the WP Admin area, not non-admin users.
#### v260301
* (Framework) **Bug Fix:** Fixed mismatched `