Three ways to protect:
- Per item: the Membership Protection box in the editor sidebar, on every page, post and custom post type. Set the levels and an optional drip delay right there
- In bulk: Protect Content tab, then Bulk Protect. Applies to every item of a content type, and optionally to one category of posts
- By category or tag: the category table on the Protect Content tab. Every post in a protected category is members only, including posts you publish later
The third one is the one people underuse. Protect a category once and every future post in it is protected the moment you publish, with nothing to remember.
What a non member sees:
Settings tab, protection behaviour. Show your protection message, show the excerpt as a teaser first, or redirect to any page. A join or sales page makes the best redirect, because somebody who just hit a locked door is the most likely person on your site to buy.
How deep the protection goes:
- The page itself, plus the content served through the WordPress REST API
- Excerpts in archives and search results, or protected items hidden from those lists entirely, which is on by default
- RSS feeds, where protected content is replaced by your message
- Comments on protected posts, which are hidden and closed for non members
The REST API one matters more than it looks. Without it, content that is locked on the page is still readable by anything that asks WordPress for it directly.
Previewing as a visitor:
Turn off Administrators Always See Everything in Settings for a moment, or use a private browser window. Checking while logged in as an administrator tells you nothing.
Caching:
A full page cache can serve a member only page to a stranger, because the cache does not know who is asking. Exclude your protected pages from full page caching.