The short answer
For simple gated content such as courses or downloads, a well-maintained membership plugin can work. For a client portal with private documents, job status or account data, a custom web app with proper authentication and access control is the safer, more maintainable choice. Membership plugins put customer accounts inside the same system as your public marketing site.
- A portal holds personal information, so a breach becomes a notifiable event.
- Custom apps can use proven sign-in services with two-factor and passkeys.
- Plugins mix customer accounts with marketing site admin.
- Map exactly what each customer must see before choosing.
Custom portal vs Membership plugin at a glance
| What matters | Custom portal | Membership plugin |
|---|---|---|
| Access control | Per record, per role, tested | Plugin rules on pages and posts |
| Sign-in | Auth provider with 2FA and passkeys | WordPress users plus add-ons |
| Separation | Separate from marketing site | Same WordPress install |
| Integrations | Direct to job or CRM system | Plugin connectors |
The stakes are different
Once customers log in to see invoices, reports or documents, the site holds personal information. In Australia, an eligible data breach must be reported under the Notifiable Data Breaches scheme. Sources: OAIC Notifiable Data Breaches
What good access control looks like
Each request checks who the user is and whether this specific record belongs to them. OWASP lists broken access control as the top web application risk, which is why it needs tests, not just page-level rules. Sources: OWASP Top 10
When a plugin is enough
Gated articles, courses and downloads where nothing is customer-specific. Choose an actively maintained plugin, enforce strong passwords and two-factor sign-in.
Our verdict
Anything customer-specific and private belongs in a custom app, kept separate from the marketing site.
Questions people ask
Is a custom portal expensive?
Scope drives it. A focused portal with sign-in, documents and status can be a modest build.
Which sign-in service should we use?
Mature options include Auth0, Clerk, Supabase Auth and Microsoft Entra ID. Pick one that supports two-factor and passkeys.
Can the portal match our website design?
Yes. It can share the same design system on a subdomain.
No affiliate links on this page at publication. Product names link to official sites so you can check current pricing. How we work.
