What a members area is
A members area is a part of a website that only certain people can open. They sign in, and content that stays closed to everybody else opens for them.
It is not an app, and it is not a separate service with its own login screen and its own monthly bill. It is the same website, with some of it reserved.
This one runs here, on hansmartens.dev. I built it to give a group access to part of a website without sending them somewhere else to get it.
What a locked post looks like
A page in a members area keeps its place. It stays on the blog alongside everything else, and its title, its date and its description stay visible to everybody. A small lock marks it.
Opening it is where the difference shows. The title is there, the date is there, the description is there — and where the post should be there is a short card instead, saying that this one is for members, with a button that leads to the sign-in page. That page asks for an email address and sends a link. Nothing else on the page changes.
The title and description staying public is the point rather than an oversight. Somebody has to be able to see that something exists, and roughly what it is, before they can decide they want to ask for it.
What is missing is the post itself. The text is never put into the page at all unless the person asking is entitled to it.
How signing in works
A member types the email address they are registered with, and a link arrives. Clicking it signs them in. There is no password to choose and nothing to install.
The link is valid for fifteen minutes and one click. The session it opens lasts a day, and after that they ask for another link.
There is no signup form. A member is a line in a file — an email address and a name — so somebody asks for access, the owner adds them, and the next deploy lets them in. That suits the kinds of websites this is for, which already know who their members are.
Which websites need one
Clubs and associations, where members have things to read that the public does not — minutes, forms, a schedule.
Courses and schools, where the material belongs to the people who signed up for it.
Bloggers and tutorial writers who keep some of what they write for readers who ask.
The common thread is a group who all see the same content, and an owner who knows who is in that group.
A members area is also how paid content usually works. A site charging for a course or a set of guides takes the payment first and adds the buyer to the list afterwards. Deciding who may read is the part a members area does; taking the money is a separate piece of work, and it is not in what I built here.
How it differs from a client portal
A client portal does the opposite.
A client portal gives each person their own. A client signs in and sees their projects, what has happened lately, what the work is waiting on from them, and their invoices. Two clients signing in see two different sets of pages. It suits a business with clients: agencies, studios, photographers, architects, accountants.
A members area gives everyone the same. There is one set of hidden content and every member sees all of it. Nobody has their own records, because there are none to have.
Which one a website needs comes down to whether the people signing in are looking at the same thing or at different things.
Why it is safe
No passwords. There is none to guess, none to steal, and none that somebody also used on a site that was later broken into. There is none for the owner to store either, and none for anybody to reset.
The link works once. Fifteen minutes, one click, and then it is dead. A link left sitting in an inbox, or forwarded to the wrong person by mistake, opens nothing.
A locked post is not a post with its text hidden. The text is never put into the page for somebody who is not entitled to it. It is not greyed out and not blurred; it is absent.
Access can be ended at any moment. A member who loses a laptop can sign out everywhere at once. Taking somebody off the list shuts them out at their next page load rather than whenever their session would have run out.
The sign-in page gives nothing away. An address that is not on the list gets the same answer as one that is, in the same words, so the form cannot be used to work out who a website’s members are.
There is no database of members. The list is a file in the website’s own code. While somebody is signed in the site keeps a note that their session is open, filed under a scrambled form of their address, and that note holds nothing else.
Locked posts stay out of the feed, the sitemap and the site’s own search, and nothing between the server and the reader keeps a copy of one.
Why it runs on my own website
To make it work and to test it. Building for yourself is the best way, because you can test it all the time — on the site you use every day, where you would notice the morning it broke.
I built this and a client portal because I’m interested in this kind of solution on an Astro website, for the businesses and clubs and other organisations that need one. A business needs the client portal. A club needs the members area. It is interesting how it works, and it has to be safe.
Also worth reading
Members Area — the one I built, and what it would be on your website.
Client Portal — for a business whose clients each need their own.