← Back to LearnDash Group Partial Content Control

Owner tools

For the owner of LearnDash Group Partial Content Control (Visit site).

Ownership

This launch is unclaimed.

Claim this launch to get an owner link, re-scan after fixes, track your score improvements, or remove your site from StackScope entirely.

Claim this launch

Start here

Three fast-win fixes from the list below, ordered by impact. Each is a drop-in change you can finish in under 30 minutes.

Add a privacy policy page Analytics detected on this site, so a privacy policy is a legal requirement under GDPR and US state privacy laws, not optional.
Add a robots.txt file
Add a sitemap.xml

4 more score-affecting fixes below, plus advisory items.

Fixes that improve your score

Security

HIGHAdd the missing security response headers
Missing: Referrer-Policy, X-Frame-Options, Permissions-Policy, Strict-Transport-Security
WhyEach header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place.
WhereMost are one line each in your server config, reverse proxy, CDN, or framework headers.
Learn more
Why this matters & sources
Per-header consequence:
- Strict-Transport-Security: Tells browsers to only ever load your site over HTTPS, even if a user types the URL without https://. Without it, a first-visit on coffee-shop wifi can be silently downgraded to HTTP and intercepted.
- X-Frame-Options: Stops other sites loading yours inside an invisible iframe to trick users into clicking buttons they can't see (clickjacking).
- Referrer-Policy: Controls how much of the current URL is sent to third-party sites and analytics. The default leaks the full path, including query strings that may contain tokens or user IDs.
- Permissions-Policy: Turns off browser features your site doesn't use (camera, microphone, geolocation, payment) so an injected script can't trigger them.

Legal & compliance

HIGHAdd a privacy policy page
Analytics detected on this site, so a privacy policy is a legal requirement under GDPR and US state privacy laws, not optional.
WhyDocuments what personal data you collect and how you use it. Without one, it's hard to demonstrate basic GDPR / CCPA compliance to regulators or users.
WhereUse a free generator like Termly or Iubenda to produce one in minutes, then link from your footer.
Learn more

Discoverability

MEDIUMAdd a robots.txt file
WhyTells search engines and bots which pages to crawl and which to skip. Without one, crawlers default to indexing everything they can reach, including admin paths and staging URLs.
WhereCreate /robots.txt at the site root. Most frameworks have a built-in path (Next.js app/robots.ts, Astro public/robots.txt).
Learn more
MEDIUMAdd a sitemap.xml
WhyHelps search engines discover all your pages, including deep-linked ones not in the navigation. Without one, only pages reachable via crawl-from-homepage get found.
WhereGenerate /sitemap.xml and reference it from robots.txt with a Sitemap: line. Frameworks usually generate it (Next.js app/sitemap.ts, Astro @astrojs/sitemap).
Learn more

Page basics & SEO

MEDIUMAdd Open Graph tags
Missing: og:title, og:description. Already have: og:image.
WhyWithout og:title, og:description, and og:image, links to your site render as bare text on Facebook, LinkedIn, and most chat apps instead of rich previews with an image.
WhereAdd <meta property="og:title" content="..."> (and the other two) to each page's <head>. Frameworks usually have a metadata API for this.
Learn more
MEDIUMSet a custom title and meta description
Missing on your page: a custom <title>.
WhyThese are the first things users see in search results. They're the only chance to earn a click before someone visits.
WhereAdd <title> and <meta name="description"> to each page's <head>.
Learn more
MEDIUMAdd Twitter card meta tags
No Twitter card tags were detected on your page.
WhyWithout them, links shared on X render as bare text instead of a rich preview card with image, title, and description. Rich cards have meaningfully higher CTR.
WhereAdd <meta name="twitter:card" content="summary_large_image">, plus twitter:title, twitter:description, and twitter:image to your <head>.
Learn more

Optional improvements

These don't change your StackScope score but cover SEO, agent-readiness, security-researcher discoverability, and compliance items worth addressing.

Security

LOWAdd /.well-known/security.txt
WhyLets security researchers report vulnerabilities responsibly through a published contact channel.
WhereCreate /.well-known/security.txt with a Contact: email and Expires: date.
Learn more

Legal & compliance

HIGHGate analytics behind consent
Analytics set tracking cookies on our visit with no opt-in step. If you gate this for real visitors in a way our crawl didn't trigger, you can ignore it.
WhyUK/EU GDPR requires opt-in before analytics scripts fire; about half of US state privacy laws now require honouring the Global Privacy Control browser signal as a universal opt-out.
WhereDrop in Cookiebot, Usercentrics, Osano, or Iubenda Consent, or hand-roll a banner plus Google's Consent Mode v2.
Learn more
Why this matters & sources
The legal landscape: UK/EU GDPR treats analytics as personal-data processing that requires opt-in consent before scripts fire. About half the US state privacy laws now in force (California, Colorado, Texas, Connecticut, Oregon, Montana, Delaware, New Hampshire, New Jersey, Nebraska) require honouring the Global Privacy Control (GPC) browser signal as a universal opt-out, and California's January 2026 regulations require visibly indicating when a GPC signal has been honoured.
Sources: IAPP US state privacy tracker (iapp.org/resources/article/us-state-privacy-legislation-tracker), California AG on GPC (oag.ca.gov/privacy/ccpa/gpc), EDPB consent guidelines (edpb.europa.eu).

Email security

HIGHAdd an SPF record
No SPF TXT record found at the apex domain.
WhyWithout SPF and DMARC, receiving servers have fewer signals to reject spoofed mail using your domain.
WherePublish a TXT record at the apex like v=spf1 include:_spf.google.com ~all (replace the include: with your real sender, then end with ~all for soft-fail or -all for strict).
Learn more
HIGHAdd a DMARC record
No DMARC record at _dmarc.{your-domain}.
WhyDMARC tells receivers what to do when mail fails SPF or DKIM. Without one, they fall back to permissive defaults and your domain is more easily spoofed.
WhereAdd a TXT record at _dmarc.{your-domain}. Start with v=DMARC1; p=none; rua=mailto:[email protected] (monitoring), then move to p=quarantine and p=reject once you're sure your real mail passes.
Learn more
MEDIUMConfigure DKIM with your email provider
No DKIM record found at the common selectors we check.
WhyDKIM signs your outbound mail with a cryptographic key receivers can verify. Without it, receivers can't tell your real mail from a spoof.
WhereAsk your email provider for their DKIM setup. It's usually one TXT record at {selector}._domainkey.{your-domain}.
Learn more
Why this matters & sources
Selectors we probe: Resend, SendGrid, Postmark, Mailchimp, Brevo, Mailgun, HubSpot, Customer.io, ConvertKit, Cloudflare Email. If you use Google Workspace, Microsoft 365, or self-hosted email with a custom selector, you may already have DKIM published and we just don't see it.
LOWAdd MTA-STS
No MTA-STS DNS record published.
WhyPrevents mail to your domain being downgraded to plaintext mid-flight by a network attacker. Most launches don't have this, so deploying it puts you a tier above generic email-security checks.
WherePublish a TXT record at _mta-sts.{your-domain} plus a policy file at https://mta-sts.{your-domain}/.well-known/mta-sts.txt.
Learn more
LOWAdd a TLS-RPT record
No TLS-RPT record at _smtp._tls.{domain}.
WhyReceivers can tell you when STARTTLS handshakes to your mail server fail. Without it, silent TLS failures are invisible.
WherePublish one TXT record at _smtp._tls.{your-domain} like v=TLSRPTv1; rua=mailto:[email protected].
Learn more

Page basics & SEO

LOWTrim your meta description to under 160 characters
Currently 6387 characters: "The missing WordPress plugin for serious LearnDash setupsLearnDash lets you assign full courses to a group. That's it. The moment you need to show only part of a course to a specific group — a single module, a handful of quizzes, one lesson branch — you hit a wall. This WordPress plugin tears that wall down.Built specifically for WordPress sites running LearnDash, it gives you precise control over what each group — and even each individual user — can actually access inside a course.If you have any questions before or after buying, feel free to get in touch.Contact us anytime and we’ll be happy to help.➡️[email protected] you run an academy, a corporate training platform, or a multi-tier subscription on LearnDash, you've probably been here:🧱 You want to sell a "Premium" version of a course with extra modules — but you have to duplicate the whole course just to hide a few lessons.🧱 One client buys the full program and another buys only "Module 3" — and you end up juggling cloned courses, messy menus, and a maintenance nightmare.🧱 A specific student in the group needs access to one extra lesson (or one blocked) — and there's no clean way to do it without breaking the group logic.🧱 You want to preview what a specific student will actually see — and LearnDash gives you no real answer.Partial Content for LearnDash fixes all of that from a single, clean tab inside the group editor.🗂️ Per-course partial access, per groupInside each group, decide course by course whether it's shown in full or in partial mode. In partial mode, you tick only the lessons, topics, and quizzes that the group should see. The rest simply disappears for those students — not hidden behind a soft lock, genuinely inaccessible.🌳 Full course tree with branch shortcutsThe selector shows the real LearnDash structure: course → lessons → topics → quizzes, nested exactly as you built it. Every branch has a "Select branch" and "Clear branch" shortcut so configuring even huge courses takes seconds.🔁 Clone from another groupAlready configured a similar group? Copy its partial access setup onto the current one in one click, then tweak only what's different. No more recreating the same selection again and again.📋 Reusable templatesSave any configuration as a named template (e.g. "Premium tier", "Trial week", "Level 2 bundle") and apply it to any group later. Templates store the base group config, not per-user exceptions, so they stay reusable and clean.🔎 Global content searchOne search box across every course in your LearnDash install. Find a lesson, topic, or quiz by name, see which course it belongs to, and — if that course is already assigned to the current group — tick it straight from the result. A huge time-saver on big catalogs.👤 Preview as studentPick any user in the group and see exactly which courses and steps they’ll see, including their personal exceptions, before saving. No more "log in as user" workarounds or test accounts.🆚 Compare with another groupCompare the current group's configuration against any other saved group. The plugin lists differences clearly: courses only in one, mode changes, and step-level differences. Perfect for auditing tiers or replicating setups across environments.🎛️ Per-user exceptionsNeed to unlock one extra lesson for a specific student, or block a quiz for another? Add per-user exceptions on top of the group's base configuration without touching the group-wide rules. Exceptions stack cleanly on top — never silently — and stay visible at a glance.⚡ Bulk actions per courseSelect all, clear all, invert selection, or select only lessons / only topics / only quizzes with a single click. Configuring a 200-step course takes under a minute.🔍 In-course live searchInside each course card there's a live filter that hides anything not matching your query as you type. Finding the one quiz you need in a massive course becomes instant.🧭 Overview dashboardA dedicated admin page that shows every group, its mode per course, number of partial courses, selected steps, and active exceptions — so you can see your whole access map without opening each group one by one.🧰 Clean integration with LearnDashThe plugin plugs into LearnDash’s native group tabs — no parallel UI, no cluttered meta boxes on top of the editor. It respects LearnDash’s capability checks and works alongside existing access rules, not against them.✅ Stop duplicating courses. One course, many tiers, many groups — each seeing exactly what they should.✅ Sell more tiers with less work. Free / Basic / Premium / Enterprise all from the same course source of truth.✅ Ship custom enterprise deals fast. A corporate client wants "only these 12 lessons"? Configure it, save it as a template, done in minutes.✅ Cut maintenance time. Edit one course once; every group that uses it stays consistent.✅ Zero surprises. The preview tool shows you what the student sees before anyone complains.✅ Handle exceptions without hacks. No custom code, no shortcodes, no duplicated enrollments.🔧 Built specifically for WordPress + LearnDash🔧 LearnDash 3.x & 4.x compatible — works with both the classic admin and the new SPA tab system.🔧 Vanilla PHP + JS, zero bloat — no React runtime, no external framework, loads only on the admin screens it needs.🔧 Namespaced and self-contained — won’t collide with other plugins.🔧 Translation-ready — full text domain, ready for .po / .mo files.🔧 No calls home, no tracking, no external services — everything runs on your server.🔧 Respects LearnDash capabilities — only users who can already edit groups can change partial access.🔧 Clean uninstall — no orphaned data left behind if you remove it.🏫 Online academies selling tiered access to the same curriculum.🏢 Corporate training teams delivering custom subsets of a master course to each client or department.🎓 Universities and schools with cohorts that need slightly different content each term.💼 Agencies managing multiple WordPress + LearnDash sites and tired of duplicating courses to fake partial access.👨‍💻 Solo creators who want to launch a Premium tier without rebuilding their course.✅ x1 plugin ZIP file — just upload it to WordPress, activate it, open any LearnDash group, and click the new "Partial Content" tab.🌐 Use it on unlimited WordPress sites🔒 Lifetime license included♾️ Lifetime updates included📩 Direct email support included"
WhyGoogle truncates around 155-160 characters on desktop SERPs (less on mobile), so anything past that won't appear in the snippet.
WhereEdit your <meta name="description"> tag. Put the most click-worthy phrase first.
Learn more

Agent / AI

LOWAdd an llms.txt file
WhyHelps AI models understand your site's content and how to use it. Not yet a standard but gaining adoption.
WhereCreate /llms.txt at the site root with a brief overview and key URLs.
Learn more
LOWDeclare a Content-Signal in robots.txt
WhyStates how you'd like AI systems to use your content (training, search, agent input). Without it, AI crawlers fall back to whatever default policy each vendor applies.
WhereAdd a Content-Signal: line to your robots.txt.
Learn more
LOWAdd Link response headers
WhyLets agents discover your sitemap, privacy policy, and docs without parsing HTML, which most lightweight agents skip.
WhereSet Link: response headers in your server config or framework middleware.
Learn more

If a tip looks wrong (for example it says "add a consent banner" and you already have one) the detection's the bug, not you. StackScope sees what's public from the outside: HTTP response, rendered HTML, cookies, and DNS. We can miss vendors that load behind consent, are self-hosted, or use an install shape we haven't fingerprinted yet. Email [email protected] and we'll look into it.

Copy into Cursor, Claude, or ChatGPT

This prompt includes the detected stack and only the fixes StackScope found. It asks the AI to make concrete file-level changes, not a vague website review.

Score-affecting basics only. Ask your AI to handle these first; come back for the optional hardening once they're done.

Everything: score-affecting fixes plus optional email security, agent metadata, and best-practice items. Longer prompt, more for an "all in one" agent run.

I own https://learndashpro.com. StackScope (https://stackscope.dev) analysed it on 24 April 2026 and scored it 3.0/10 against their production-readiness checklist. Please help me apply the fixes below. These are the score-affecting basics. We'll circle back to the optional hardening (email security, advanced agent metadata) later.

Tech stack StackScope detected on the site (use this when suggesting where each fix lives in the codebase):
braintree, cloudflare, cloudflare-insights, dropbox, facebook, facebook-pixel, facebook-sdk, google-ads, google-analytics, google-search, google-tag-manager, gumroad, hostinger-dns, iframely, jwplayer, mailchimp, og-product, openresty, paypal, plausible, rails, shadcn-ui, stripe, tailwindcss, twitter, twitter-ads, youtube

Score-affecting fixes (these improve the StackScope score; [HIGH] = most impact):
- [HIGH] Add a privacy policy page. Analytics detected on this site, so a privacy policy is a legal requirement under GDPR and US state privacy laws, not optional. Why: Documents what personal data you collect and how you use it. Without one, it's hard to demonstrate basic GDPR / CCPA compliance to regulators or users. Where: Use a free generator like Termly or Iubenda to produce one in minutes, then link from your footer. (https://www.termly.io/products/privacy-policy-generator/)
- [HIGH] Add the missing security response headers. Missing: Referrer-Policy, X-Frame-Options, Permissions-Policy, Strict-Transport-Security Why: Each header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place. Where: Most are one line each in your server config, reverse proxy, CDN, or framework headers. (https://owasp.org/www-project-secure-headers/)
- [MEDIUM] Add a robots.txt file. Why: Tells search engines and bots which pages to crawl and which to skip. Without one, crawlers default to indexing everything they can reach, including admin paths and staging URLs. Where: Create `/robots.txt` at the site root. Most frameworks have a built-in path (Next.js `app/robots.ts`, Astro `public/robots.txt`). (https://developers.google.com/search/docs/crawling-indexing/robots/intro)
- [MEDIUM] Add a sitemap.xml. Why: Helps search engines discover all your pages, including deep-linked ones not in the navigation. Without one, only pages reachable via crawl-from-homepage get found. Where: Generate `/sitemap.xml` and reference it from `robots.txt` with a `Sitemap:` line. Frameworks usually generate it (Next.js `app/sitemap.ts`, Astro `@astrojs/sitemap`). (https://developers.google.com/search/docs/crawling-indexing/sitemaps/overview)
- [MEDIUM] Add Open Graph tags. Missing: `og:title`, `og:description`. Already have: `og:image`. Why: Without `og:title`, `og:description`, and `og:image`, links to your site render as bare text on Facebook, LinkedIn, and most chat apps instead of rich previews with an image. Where: Add `<meta property="og:title" content="...">` (and the other two) to each page's `<head>`. Frameworks usually have a metadata API for this. (https://ogp.me/)
- [MEDIUM] Set a custom title and meta description. Missing on your page: a custom `<title>`. Why: These are the first things users see in search results. They're the only chance to earn a click before someone visits. Where: Add `<title>` and `<meta name="description">` to each page's `<head>`. (https://developers.google.com/search/docs/appearance/title-link)
- [MEDIUM] Add Twitter card meta tags. No Twitter card tags were detected on your page. Why: Without them, links shared on X render as bare text instead of a rich preview card with image, title, and description. Rich cards have meaningfully higher CTR. Where: Add `<meta name="twitter:card" content="summary_large_image">`, plus `twitter:title`, `twitter:description`, and `twitter:image` to your `<head>`. (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name)

For each item, tell me exactly which file to create or which code to change, and where it lives in a project using the stack above. If my framework has a native API for the task (e.g. Next.js metadata exports, `app/sitemap.ts`, Astro layouts, Nuxt `useHead`), prefer that over raw HTML or server config.

Full analysis: https://stackscope.dev/launch/m6ii4a1a/learndash-group-partial-content-control

I own https://learndashpro.com. StackScope (https://stackscope.dev) analysed it on 24 April 2026 and scored it 3.0/10 against their production-readiness checklist. Please help me apply the fixes below. This is a checklist, not a blocker list; Score-affecting fixes are the ones that move the number, Optional items are nice-to-haves with zero score impact that I can skip for an MVP.

Tech stack StackScope detected on the site (use this when suggesting where each fix lives in the codebase):
braintree, cloudflare, cloudflare-insights, dropbox, facebook, facebook-pixel, facebook-sdk, google-ads, google-analytics, google-search, google-tag-manager, gumroad, hostinger-dns, iframely, jwplayer, mailchimp, og-product, openresty, paypal, plausible, rails, shadcn-ui, stripe, tailwindcss, twitter, twitter-ads, youtube

Score-affecting fixes (these improve the StackScope score; [HIGH] = most impact):
- [HIGH] Add a privacy policy page. Analytics detected on this site, so a privacy policy is a legal requirement under GDPR and US state privacy laws, not optional. Why: Documents what personal data you collect and how you use it. Without one, it's hard to demonstrate basic GDPR / CCPA compliance to regulators or users. Where: Use a free generator like Termly or Iubenda to produce one in minutes, then link from your footer. (https://www.termly.io/products/privacy-policy-generator/)
- [HIGH] Add the missing security response headers. Missing: Referrer-Policy, X-Frame-Options, Permissions-Policy, Strict-Transport-Security Why: Each header limits a class of browser-side attack: clickjacking, XSS, MIME sniffing, plaintext fallback. Missing headers leave default-permissive behaviour in place. Where: Most are one line each in your server config, reverse proxy, CDN, or framework headers. (https://owasp.org/www-project-secure-headers/)
- [MEDIUM] Add a robots.txt file. Why: Tells search engines and bots which pages to crawl and which to skip. Without one, crawlers default to indexing everything they can reach, including admin paths and staging URLs. Where: Create `/robots.txt` at the site root. Most frameworks have a built-in path (Next.js `app/robots.ts`, Astro `public/robots.txt`). (https://developers.google.com/search/docs/crawling-indexing/robots/intro)
- [MEDIUM] Add a sitemap.xml. Why: Helps search engines discover all your pages, including deep-linked ones not in the navigation. Without one, only pages reachable via crawl-from-homepage get found. Where: Generate `/sitemap.xml` and reference it from `robots.txt` with a `Sitemap:` line. Frameworks usually generate it (Next.js `app/sitemap.ts`, Astro `@astrojs/sitemap`). (https://developers.google.com/search/docs/crawling-indexing/sitemaps/overview)
- [MEDIUM] Add Open Graph tags. Missing: `og:title`, `og:description`. Already have: `og:image`. Why: Without `og:title`, `og:description`, and `og:image`, links to your site render as bare text on Facebook, LinkedIn, and most chat apps instead of rich previews with an image. Where: Add `<meta property="og:title" content="...">` (and the other two) to each page's `<head>`. Frameworks usually have a metadata API for this. (https://ogp.me/)
- [MEDIUM] Set a custom title and meta description. Missing on your page: a custom `<title>`. Why: These are the first things users see in search results. They're the only chance to earn a click before someone visits. Where: Add `<title>` and `<meta name="description">` to each page's `<head>`. (https://developers.google.com/search/docs/appearance/title-link)
- [MEDIUM] Add Twitter card meta tags. No Twitter card tags were detected on your page. Why: Without them, links shared on X render as bare text instead of a rich preview card with image, title, and description. Rich cards have meaningfully higher CTR. Where: Add `<meta name="twitter:card" content="summary_large_image">`, plus `twitter:title`, `twitter:description`, and `twitter:image` to your `<head>`. (https://developer.mozilla.org/en-US/docs/Web/HTML/Element/meta/name)

Optional best-practice improvements (no score impact):
- [HIGH] Gate analytics behind consent. Analytics set tracking cookies on our visit with no opt-in step. If you gate this for real visitors in a way our crawl didn't trigger, you can ignore it. Why: UK/EU GDPR requires opt-in before analytics scripts fire; about half of US state privacy laws now require honouring the Global Privacy Control browser signal as a universal opt-out. Where: Drop in Cookiebot, Usercentrics, Osano, or Iubenda Consent, or hand-roll a banner plus Google's `Consent Mode v2`. (https://iapp.org/resources/article/us-state-privacy-legislation-tracker)
- [HIGH] Add an SPF record. No SPF TXT record found at the apex domain. Why: Without SPF and DMARC, receiving servers have fewer signals to reject spoofed mail using your domain. Where: Publish a TXT record at the apex like `v=spf1 include:_spf.google.com ~all` (replace the `include:` with your real sender, then end with `~all` for soft-fail or `-all` for strict). (https://www.cloudflare.com/learning/dns/dns-records/dns-spf-record/)
- [HIGH] Add a DMARC record. No DMARC record at `_dmarc.{your-domain}`. Why: DMARC tells receivers what to do when mail fails SPF or DKIM. Without one, they fall back to permissive defaults and your domain is more easily spoofed. Where: Add a TXT record at `_dmarc.{your-domain}`. Start with `v=DMARC1; p=none; rua=mailto:dmarc@yourdomain.com` (monitoring), then move to `p=quarantine` and `p=reject` once you're sure your real mail passes. (https://dmarc.org/overview/)
- [MEDIUM] Configure DKIM with your email provider. No DKIM record found at the common selectors we check. Why: DKIM signs your outbound mail with a cryptographic key receivers can verify. Without it, receivers can't tell your real mail from a spoof. Where: Ask your email provider for their DKIM setup. It's usually one TXT record at `{selector}._domainkey.{your-domain}`. (https://www.cloudflare.com/learning/dns/dns-records/dns-dkim-record/)
- [LOW] Trim your meta description to under 160 characters. Currently 6387 characters: "The missing WordPress plugin for serious LearnDash setupsLearnDash lets you assign full courses to a group. That's it. The moment you need to show only part of a course to a specific group — a single module, a handful of quizzes, one lesson branch — you hit a wall. This WordPress plugin tears that wall down.Built specifically for WordPress sites running LearnDash, it gives you precise control over what each group — and even each individual user — can actually access inside a course.If you have any questions before or after buying, feel free to get in touch.Contact us anytime and we’ll be happy to help.➡️gumroad.clamor798@8shield.netIf you run an academy, a corporate training platform, or a multi-tier subscription on LearnDash, you've probably been here:🧱 You want to sell a "Premium" version of a course with extra modules — but you have to duplicate the whole course just to hide a few lessons.🧱 One client buys the full program and another buys only "Module 3" — and you end up juggling cloned courses, messy menus, and a maintenance nightmare.🧱 A specific student in the group needs access to one extra lesson (or one blocked) — and there's no clean way to do it without breaking the group logic.🧱 You want to preview what a specific student will actually see — and LearnDash gives you no real answer.Partial Content for LearnDash fixes all of that from a single, clean tab inside the group editor.🗂️ Per-course partial access, per groupInside each group, decide course by course whether it's shown in full or in partial mode. In partial mode, you tick only the lessons, topics, and quizzes that the group should see. The rest simply disappears for those students — not hidden behind a soft lock, genuinely inaccessible.🌳 Full course tree with branch shortcutsThe selector shows the real LearnDash structure: course → lessons → topics → quizzes, nested exactly as you built it. Every branch has a "Select branch" and "Clear branch" shortcut so configuring even huge courses takes seconds.🔁 Clone from another groupAlready configured a similar group? Copy its partial access setup onto the current one in one click, then tweak only what's different. No more recreating the same selection again and again.📋 Reusable templatesSave any configuration as a named template (e.g. "Premium tier", "Trial week", "Level 2 bundle") and apply it to any group later. Templates store the base group config, not per-user exceptions, so they stay reusable and clean.🔎 Global content searchOne search box across every course in your LearnDash install. Find a lesson, topic, or quiz by name, see which course it belongs to, and — if that course is already assigned to the current group — tick it straight from the result. A huge time-saver on big catalogs.👤 Preview as studentPick any user in the group and see exactly which courses and steps they’ll see, including their personal exceptions, before saving. No more "log in as user" workarounds or test accounts.🆚 Compare with another groupCompare the current group's configuration against any other saved group. The plugin lists differences clearly: courses only in one, mode changes, and step-level differences. Perfect for auditing tiers or replicating setups across environments.🎛️ Per-user exceptionsNeed to unlock one extra lesson for a specific student, or block a quiz for another? Add per-user exceptions on top of the group's base configuration without touching the group-wide rules. Exceptions stack cleanly on top — never silently — and stay visible at a glance.⚡ Bulk actions per courseSelect all, clear all, invert selection, or select only lessons / only topics / only quizzes with a single click. Configuring a 200-step course takes under a minute.🔍 In-course live searchInside each course card there's a live filter that hides anything not matching your query as you type. Finding the one quiz you need in a massive course becomes instant.🧭 Overview dashboardA dedicated admin page that shows every group, its mode per course, number of partial courses, selected steps, and active exceptions — so you can see your whole access map without opening each group one by one.🧰 Clean integration with LearnDashThe plugin plugs into LearnDash’s native group tabs — no parallel UI, no cluttered meta boxes on top of the editor. It respects LearnDash’s capability checks and works alongside existing access rules, not against them.✅ Stop duplicating courses. One course, many tiers, many groups — each seeing exactly what they should.✅ Sell more tiers with less work. Free / Basic / Premium / Enterprise all from the same course source of truth.✅ Ship custom enterprise deals fast. A corporate client wants "only these 12 lessons"? Configure it, save it as a template, done in minutes.✅ Cut maintenance time. Edit one course once; every group that uses it stays consistent.✅ Zero surprises. The preview tool shows you what the student sees before anyone complains.✅ Handle exceptions without hacks. No custom code, no shortcodes, no duplicated enrollments.🔧 Built specifically for WordPress + LearnDash🔧 LearnDash 3.x &amp; 4.x compatible — works with both the classic admin and the new SPA tab system.🔧 Vanilla PHP + JS, zero bloat — no React runtime, no external framework, loads only on the admin screens it needs.🔧 Namespaced and self-contained — won’t collide with other plugins.🔧 Translation-ready — full text domain, ready for .po / .mo files.🔧 No calls home, no tracking, no external services — everything runs on your server.🔧 Respects LearnDash capabilities — only users who can already edit groups can change partial access.🔧 Clean uninstall — no orphaned data left behind if you remove it.🏫 Online academies selling tiered access to the same curriculum.🏢 Corporate training teams delivering custom subsets of a master course to each client or department.🎓 Universities and schools with cohorts that need slightly different content each term.💼 Agencies managing multiple WordPress + LearnDash sites and tired of duplicating courses to fake partial access.👨‍💻 Solo creators who want to launch a Premium tier without rebuilding their course.✅ x1 plugin ZIP file — just upload it to WordPress, activate it, open any LearnDash group, and click the new "Partial Content" tab.🌐 Use it on unlimited WordPress sites🔒 Lifetime license included♾️ Lifetime updates included📩 Direct email support included" Why: Google truncates around 155-160 characters on desktop SERPs (less on mobile), so anything past that won't appear in the snippet. Where: Edit your `<meta name="description">` tag. Put the most click-worthy phrase first. (https://developers.google.com/search/docs/appearance/snippet)
- [LOW] Add /.well-known/security.txt. Why: Lets security researchers report vulnerabilities responsibly through a published contact channel. Where: Create `/.well-known/security.txt` with a `Contact:` email and `Expires:` date. (https://securitytxt.org/)
- [LOW] Add an llms.txt file. Why: Helps AI models understand your site's content and how to use it. Not yet a standard but gaining adoption. Where: Create `/llms.txt` at the site root with a brief overview and key URLs. (https://llmstxt.org/)
- [LOW] Declare a Content-Signal in robots.txt. Why: States how you'd like AI systems to use your content (training, search, agent input). Without it, AI crawlers fall back to whatever default policy each vendor applies. Where: Add a `Content-Signal:` line to your `robots.txt`. (https://contentsignals.org/)
- [LOW] Add Link response headers. Why: Lets agents discover your sitemap, privacy policy, and docs without parsing HTML, which most lightweight agents skip. Where: Set `Link:` response headers in your server config or framework middleware. (https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Link)
- [LOW] Add MTA-STS. No MTA-STS DNS record published. Why: Prevents mail to your domain being downgraded to plaintext mid-flight by a network attacker. Most launches don't have this, so deploying it puts you a tier above generic email-security checks. Where: Publish a TXT record at `_mta-sts.{your-domain}` plus a policy file at `https://mta-sts.{your-domain}/.well-known/mta-sts.txt`. (https://datatracker.ietf.org/doc/html/rfc8461)
- [LOW] Add a TLS-RPT record. No TLS-RPT record at `_smtp._tls.{domain}`. Why: Receivers can tell you when STARTTLS handshakes to your mail server fail. Without it, silent TLS failures are invisible. Where: Publish one TXT record at `_smtp._tls.{your-domain}` like `v=TLSRPTv1; rua=mailto:tls-reports@yourdomain.com`. (https://datatracker.ietf.org/doc/html/rfc8460)

For each item, tell me exactly which file to create or which code to change, and where it lives in a project using the stack above. If my framework has a native API for the task (e.g. Next.js metadata exports, `app/sitemap.ts`, Astro layouts, Nuxt `useHead`), prefer that over raw HTML or server config.

Full analysis: https://stackscope.dev/launch/m6ii4a1a/learndash-group-partial-content-control

Using an autonomous agent?

Point the agent at this SKILL.md URL and ask it to follow the skill. The framing stops agents defaulting to an open-ended page review.

https://stackscope.dev/launch/m6ii4a1a/skill.md

Share your score

Your score card renders automatically when you share the link.

Or embed a badge

Two badge options. Pick whichever fits your story.

Current score

Shows the latest score and updates within a few minutes of any recrawl. Best for ongoing display: if you fix something and recrawl, the badge reflects the new score automatically.

<a href="https://stackscope.dev/launch/m6ii4a1a/learndash-group-partial-content-control"><img src="https://stackscope.dev/badge/m6ii4a1a/current.svg" alt="StackScope score for LearnDash Group Partial Content Control" height="24" /></a>

Launch score

Pinned to your launch-day snapshot and never changes. Marked with a small gold corner ribbon. Best for press kits, launch retrospectives, or anywhere you want a permanent record of how you shipped.

<a href="https://stackscope.dev/launch/m6ii4a1a/learndash-group-partial-content-control"><img src="https://stackscope.dev/badge/m6ii4a1a.svg" alt="StackScope launch score for LearnDash Group Partial Content Control" height="24" /></a>

Using a Content-Security-Policy? Both badges are <img> tags from our domain, so your CSP needs to allow them. Add stackscope.dev to your img-src directive (example: img-src 'self' stackscope.dev;). Without it, browsers silently block the badge and visitors see a broken image.