Evaluation Criteria for Membership Site Security, Caching, and Backups in AccessAlly

Security, backups, and caching are all extremely important functions for a membership site. Unfortunately, it can be difficult to choose between using a plugin or your server’s built-in capabilities.

Since not all plugins and servers are built the same, what’s considered “good practice” for one server might be frowned on by another. And, while using the server’s functionality is usually recommended over a plugin, this is not always the case (some servers, for example, have notoriously bad caching. In this case, a caching plugin would be preferable).

Just be aware of the warning signs that appear when your business has outgrown the security tools you’re using.

Evaluation Criteria

To help in your decision, use the following as your evaluation criteria:

• PERFORMANCE: Does it slow down the site? (This is especially important for backups – when a backup operation is underway, does the site slow down?)
• STORAGE: Does the plugin you’re using clog up the site with junk? Does it duplicate files on your server (taking up valuable storage)? Here, you’ll want to look for the “free space” measure on your server.
• CONSISTENCY: Does the tool always perform as required, or does it fail sometimes?
• FLEXIBILITY: Does the tool allow customization? Well-built tools know the world is full of exceptions, so they allow for certain files / use cases to be whitelisted.
• DISCONNECT: Does the tool block communication from CRM to server, which results in missed signals and can restrict users’ access to your site?

Use these criteria when determining the best course of action for the following functions:

Website Backups

Ideally, site backups should be done on the server level by your host. Please confirm with your host on the following items:

• The frequency of backups
• How to restore backups

If your host does recommend a secondary backup plugin, be selective with the solutions you choose. Evaluate the options against the following considerations:

• Ease of use: Backups are most needed when bad things happen. The restore must be easy (can be done without complicated operations) and complete (full revert to the restore point, including files and database). The Gold standard here is the WPEngine backup points.
• Flexibility: A backup can be triggered when needed. It’s also good to have the option to backup / restore only file or database.

Backup & Caching Plugins to avoid:

• Updraft (older versions)
• WP DB Backup
• WP DB Manager
• BackupWordPress

Recommended backup plugins:

• VaultPress
• BackupBuddy
• Updraft Plus

Anti-Spam Plugins

How to Exclude AccessAlly Pages from Caching

Page caching can dramatically speed up your WordPress site, but certain AccessAlly pages must never be cached. Caching these pages causes [02002] errors, failed transactions, and login issues that block your sales.

Which Pages Must NOT Be Cached

The following AccessAlly pages must always be excluded from caching:

• Order forms – Any page with AccessAlly order forms or buy buttons
• Login pages – Your custom login page or WordPress /wp-login.php
• Checkout pages – Pages with payment forms
• Member dashboard – Pages with dynamic user content
• Course progress pages – Pages showing user-specific progress
• Protected content pages – Pages with conditional content based on tags/purchases

💡 Why? These pages use dynamic content that changes based on the logged-in user. Caching them causes errors like [02002], prevents purchases, or shows the wrong content to users.

How to Exclude AccessAlly Pages from Caching

Method 1: WP Rocket (Most Popular)

WP Rocket is one of the most popular caching plugins. Here’s how to exclude AccessAlly pages:

1. Go to WP Rocket Settings
   • In WordPress admin, go to Settings → WP Rocket
2. Navigate to Advanced Rules
   • Click the “Advanced Rules” tab
   • Find the “Never Cache URL(s)” section
3. Add exclusion patterns
   • Add each of these URLs (one per line):

   /accessally-order/(.*)
   /order-form/(.*)
   /checkout/
   /login/
   /register/
   /my-account/(.*)

4. Save settings
   • Click “Save Changes”
   • Clear your cache (WP Rocket → “Clear Cache” button)
   • Test an order form to ensure [02002] errors are gone

W3 Total Cache

1. Go to Performance → Page Cache in WordPress admin
2. Scroll to “Never cache the following pages”
3. Add these page paths: (one per line)

   /order/*
   /login/
   /register/
   /checkout/
   /cart/
   /my-account/

4. Save settings
5. Clear all caches and test your order forms

WP Super Cache

1. Go to Settings → WP Super Cache
2. Click the “Advanced” tab
3. Scroll to “Rejected URLs” section
4. Add these URLs (one per line):

   /order-form/
   /login/
   /logout/
   /my-account/
   /checkout/
   

5. Click “Save Changes”
6. Clear all caches

LiteSpeed Cache

1. Go to LiteSpeed Cache → Page Optimization
2. Scroll to “URI Excludes” section
3. Add each AccessAlly page URL pattern on a new line:

   /order/*
   /login/
   /register/
   /my-account/*
   /checkout/

4. Save changes
5. Clear cache and test

WP Fastest Cache

1. Go to WP Fastest Cache → Settings
2. Scroll to “Exclude Pages”
3. Add these URL patterns (one per line):

   /order-*
   /checkout*
   /login*
   /logout
   /my-account
   /cart

4. Save settings
5. Clear all cache

WP Super Cache

1. Go to Settings → WP Super Cache
2. Click the “Advanced” tab
3. Find “Accepted Filenames & Rejected URIs” section
4. Add these paths (one per line) to “Rejected URLs”:

   /order-form/
   /checkout/
   /login/
   /logout/
   /my-account/

5. Click “Save Settings”
6. Clear your cache

LiteSpeed Cache

1. Go to LiteSpeed Cache → Cache → Excludes
2. In the “Do Not Cache URIs” field, add these paths (one per line):

   /order-form/
   /checkout/
   /login/
   /my-account/
   /cart/

3. Click “Save Changes”
4. Purge all caches

WP Super Cache

1. Go to Settings → WP Super Cache
2. Click the “Advanced” tab
3. Scroll to “Rejected URLs” section
4. Add these patterns (one per line):

   /order/
   /checkout/
   /cart/
   /login/
   /register/
   /account/

5. Click “Save Settings”
6. Clear all caches

Option 2: W3 Total Cache

1. Go to Performance → Page Cache
2. Scroll to “Never cache the following pages”
3. Add your order form URLs (one per line):

   /order/*
   /checkout/*
   /purchase/*
   /buy/*
   /login/
   /register/
   /my-account/*

4. Save settings
5. Empty all caches

Option 3: WP Super Cache

1. Go to Settings → WP Super Cache
2. Click the “Advanced” tab
3. Scroll to “Rejected URLs”
4. Add patterns to reject:

   /order/
   /checkout/
   /purchase/
   /buy/
   /login/
   /register/
   /my-account/

5. Click “Save Settings”
6. Delete cache

Option 4: LiteSpeed Cache

1. Go to LiteSpeed Cache → Cache
2. Click the “Excludes” tab
3. In “Do Not Cache URIs”, add:

   /order
   /checkout
   /purchase
   /buy
   /login
   /register
   /my-account

4. Save changes
5. Purge all caches

Option 5: Server-Level Caching (Cloudflare, etc.)

If you’re using server-level caching or a CDN like Cloudflare:

Cloudflare:

1. Log in to Cloudflare dashboard
2. Go to Caching → Configuration
3. Scroll to “Cache Rules”
4. Create a new rule: “Bypass cache if URL path starts with /order/”
5. Repeat for all dynamic paths: /checkout/, /buy/, /login/, /register/

Other CDNs/Hosting:

• WP Engine: Contact support to exclude URLs from page cache
• Kinsta: Add exclusions via MyKinsta dashboard
• Flywheel: Managed WordPress handles this automatically
• SiteGround: Use SG Optimizer plugin to exclude URLs

How to Test If Caching Is Fixed

After excluding your order forms from cache:

1. Clear all caches (plugin cache, browser cache, CDN cache)
2. Open your order form in a private/incognito browser window
3. Try to complete a purchase
4. Verify you don’t get [02002] errors
5. Check browser developer tools (F12 → Network tab) – order form should show “Cache: MISS” or “no-cache” headers

Troubleshooting: [02002] Error Persists

If you’re still getting [02002] errors after excluding pages from cache:

1. Check Browser Cache

• Clear your browser cache completely
• Test in a private/incognito window
• Try a different browser

2. Check CDN Cache

• If using Cloudflare, click “Purge Everything”
• Wait 5-10 minutes for purge to complete
• Test again

3. Check Multiple Caching Layers

• You might have BOTH a caching plugin AND server-level caching
• Check with your hosting provider if they have server-level caching enabled
• Exclude URLs from ALL caching layers

4. Verify Page Exclusions

• Use developer tools to check HTTP headers
• Press F12 → Network tab → Reload order form
• Click on the page request
• Look for headers like Cache-Control: no-cache or X-Cache: MISS
• If you see X-Cache: HIT, the page is still being cached

5. Check .htaccess Rules

• Some caching plugins add rules to .htaccess
• Make sure there are no conflicting cache rules
• Consult with a developer if unsure

Prevention Checklist: Before Installing Caching

To avoid caching issues from the start:

1. ✅ Identify all dynamic pages before enabling caching:
   • Order forms (all AccessAlly order form pages)
   • Login/registration pages
   • User account pages
   • Checkout pages
   • Any page with forms that process payments
2. ✅ Configure cache exclusions first, then enable caching
3. ✅ Test order forms after enabling caching
4. ✅ Test logged-in user experience (content access, downloads)
5. ✅ Keep caching plugins updated
6. ✅ Don’t use aggressive caching settings (like “cache everything”)

Recommended Caching Strategy for AccessAlly Sites

Best practice:

• Cache static pages: Sales pages, blog posts, static content
• Don’t cache dynamic pages: Order forms, login, user dashboards, protected content
• Use object caching: Redis or Memcached for database queries
• Use CDN caching: For images, CSS, JavaScript – but NOT HTML pages with forms
• Set appropriate cache expiration: 1-7 days for most content

Need Help with Caching Configuration? Caching configuration can be complex. If you’re not comfortable editing these settings, consider hiring a WordPress developer or contacting your hosting provider’s support team for assistance.

💡 Pro Tip: The performance benefit of caching is most important for high-traffic public pages. It’s safer to be conservative and exclude more pages than necessary, rather than risk caching dynamic content and breaking functionality.

• CleanTalk – the custom contact form protection feature causes issues with AccessAlly order form fields and AccessAlly coupon codes. We recommend turning custom contact form protection off if using CleanTalk.

Here are the steps to turn CleanTalk custom contact form protection off.

1. In the top bar of your WordPress Site, hover over CleanTalk.
2. Hover over AntiSpam, select Settings
3. Select Advanced Settings (this is a link midway on the settings page)
4. Turn Custom contact form protection from On to Off
5. Save your changes

Caching Plugins

Most hosts have built in caching at the server level, so the use of a caching plugin may not be required.

Please check with your host on your cache settings. Two specific settings to know include:

• How frequently your cache is cleared by the host (it may be on a schedule)
• Whether it is possible for you to clear manually in the event you are making real time changes

Some caching plugins can cause issues with versioning of the site and display items inaccurately.

If your host suggests that you DO use a plugin to assist with site caching, be sure to exclude AccessAlly. Then, remember to clear your plugin cache and server cache when you are making changes that you want to view/make live immediately.

Flywheel Hosting Blocking Affiliate Cookies

If using Flywheel hosting it may block tracking cookies. You’ll need to contact Flywheel and ask them to add paths to your caching exclusions (ignore the extra characters)
^/~access/*
^/accessallyref/*

Anything falling after those paths on your site will not be cached after this. It takes about 5 minutes to ask for this via Flywheel chat.

WPEngine Hosting Issues

If you’re experiencing issues and you have hosting through WPEngine our best recommendation is to reach out to them to ask them to turn off the cache site-wide.

You can reference this ticket when contacting WPEngine.

https://wpengine.zendesk.com/agent/tickets/3976604

Caching Specifics for Your Membership Site

There are a couple different considerations for caching a membership site built with AccessAlly:

Styling
When styling is updated in AccessAlly / PopupAlly Pro, it is recommended to manually flush / clear the cache. If clients prefer not to do that, then they should whitelist the styling files:
• AccessAlly: all files in /wp-content/uploads/accessally-scripts/
• ProgressAlly: all files in /wp-content/progressally-css/
• PopupAlly Pro: all files in /wp-content/popupally-pro-scripts/
Page cache: some pages just shouldn’t be cached
• When users are logged in, no page is cached. This is usually the case, but there are some hosts that do not always do this properly (GoDaddy is one well-known example).
• Page with timers / countdowns should be excluded from the cache.

Some Caching plugins to avoid:

• WP Super Cache
• W3 Total Cache
• WP Cache
• WP Cachecom
• WP Fast Cache / WP Fastest Cache
• WP File Cache
• WP Rocket
• Hummingbird – the javascript modification settings may cause issues with buttons on AccessAlly order forms.

Recommended caching plugins:

• Check with your host to see if they offer caching at the server level

Security Plugins

Always approach security plugins with caution. Most hosts will have plugin recommendations that match their server settings and they can recommend the best solution for you.

After choosing a security plugin, always look to whitelist or make exceptions for the CRM system and server to communicate.

Also, know that security plugins should be regularly updated as vulnerabilities are often patched and pushed out.

Security plugins to avoid:

• All in One WP Security & Firewall
• Wordfence
• Sucuri
• All SSL Plugins – this should be installed on the server level by your host. Please confirm with them on the process to get that installed.**
• CDN powered by Fastly

Security plugins to consider

• iThemes Security
• Cloudflare

NOTE: You will need to review the plugin settings to allow the CRM to communicate with the server and back to the CRM. This may require you to whitelist IPs of these tools within the security plugin as the communication must be permitted to run a membership site:

Captcha Login Plugins

While it may be tempting to install a WordPress captcha login plugin, which asks people to enter numbers and letters or show that they’re not a robot, these plugins can interfere with AccessAlly.

It can create a poor login experience for clients when you install a captcha login plugin, which is why we don’t recommend them. Captcha plugins also don’t increase the security of your site enough to warrant the poor user experience they can cause. Here are a few ways that these plugins can prevent clients from accessing their courses:

1. On-demand custom operations may not work
2. The login form password reset functionality may not work

Please consider these issues before installing a captcha plugin!

Siteground Hosting Related

The SiteGround Speed Optimizer plugin can cause issues with CommunityAlly group posts. We recommend deactivating this plugin.

SiteGround antibot AI may mistakenly flag AccessAlly webhooks as bots.

This can be found on your CRM webhook logs. These will return a 200 or 202 code. And, appears as .well-known/sgcaptcha

If this issue affects your site, new members will appear in your CRM system moving through automations – but, new members will not appear as users in your AccessAlly site.

We recommend reaching out to SiteGround to have this feature disabled or to have SiteGround resolve the flagging issue.