Institutional access lets you grant gated content access to readers based on their organization — without requiring individual paid subscriptions. It’s designed for libraries, schools, newsrooms, and companies who want to provide access to their staff, students, or patrons.

The Institutions screen under Access control, listing institutions such as a public library, university, and high school with their email domains and IP ranges for granting content access.

Setting up an institution

  1. Go to Newspack → Audience → Access Control → Institutions.
  2. Click Add Institution.
  3. Give the institution a name (shown on the access verification page).
  4. Configure access using one or more of the methods below.
  5. Save.

An institution also has two optional fields:

  • Logo — an image displayed on the access verification page alongside the institution name.
  • Description — an optional note for internal reference.

Editing and deleting an institution

From the Institutions list, click an institution (or use the Edit action) to open the editor. You can update the name, description, logo, and access methods, then Save.

To delete an institution, open the editor and choose Delete from the “more” menu, or use the Delete action directly from the list view.

Access methods

You can enable one or more access methods per institution. They use OR logic — a reader matching any enabled method is granted access.

The Add institution form's Access rules section, with the Email domain and IP range methods enabled and filled in with a domain and a CIDR block, and the Reader data method available.

IP address range

Anyone browsing from a recognized IP address range (e.g., a library’s network, a university campus) is automatically granted access. No login required.

Enter the institution’s IP range in CIDR notation (e.g., 192.168.1.0/24) in the IP Range field. You can enter multiple IPs or CIDR blocks separated by commas (e.g., 192.168.1.0/24, 10.0.0.5). Access is verified on each page load — if the reader’s IP matches, they can read gated content immediately. Only IPv4 addresses are supported.

For readers on recognized networks, a 1-year cookie is set after their first verified visit. This means they retain access for a year even if they temporarily leave the network (e.g., work from home). After that, they need to return to the network to re-verify.

Email domain

Anyone who registers with an email address matching a specified domain (e.g., @university.edu, @company.com) is automatically granted access when they log in. The reader must have a registered account using their organizational email.

Enter the email domain in the Email Domain field (without the @). Example: university.edu. You can enter multiple domains separated by commas (e.g., university.edu, school.org). The email address must be verified to match — unverified emails will not grant access.

Reader data

An advanced method that matches readers by custom metadata stored on their reader profile. Use this for sites that store custom data on reader accounts.

Enter key=value pairs in the Reader Data field, separated by semicolons. Example: org=university;role=staff. The reader must match all specified key-value pairs (AND logic within this method).

Which content is covered

Creating an institution does not gate anything on its own — you have to point your gates at it. On each gate that institutional readers should get past, open Paid Access, switch on the Institutional access condition, and choose the institutions it covers. A reader who matches then satisfies that gate the same way a paying subscriber does.

A gate without that condition still blocks institutional readers, so add it to every gate the institution is meant to unlock. Leaving the condition on but selecting no institutions lets everyone past it, which is rarely what you want.

The institutional access verification URL

Each institution has a dedicated verification URL that triggers an IP-based access check. It’s primarily used for IP range access, letting an institution distribute a link that members visit from the organization’s network. Email domain and reader data access don’t require this check, but the URL will still validate them if visited.

Finding the URL

From the Institutions list, use the Copy access page URL action on any institution. The URL follows this pattern:

https://yoursite.com/institutional-access/<institution-slug>/

Where <institution-slug> is the URL-friendly version of the institution name.

How to use it

Share this URL with the institution’s IT department or include it on the institution’s intranet. Members should visit it while connected to the institution’s network (e.g., on campus or via VPN).

What happens when a member visits the URL

  1. A verification page loads, showing the institution’s logo and name with a “Verifying your access…” message.
  2. The page checks the visitor’s connection against the institution’s access rules.
  3. If the session matches, a success message appears — “Connected to [Institution Name].” — a 1-year cookie is set, and the visitor is redirected back to the site (or to a specific page if a redirect_to parameter was included in the URL).
  4. If the session does not match, a message appears: “We couldn’t verify your location. Make sure you’re on your organization’s network and try again.” The visitor can retry or continue to the site without institutional access.

The cookie is used for cache-busting so logged-out sessions can be validated. Having the cookie in the browser does not by itself grant access to restricted content.

Redirecting after verification

Append a redirect_to parameter to send the visitor to a specific page after verification:

https://yoursite.com/institutional-access/<institution-slug>/?redirect_to=/premium-article/

This is useful for linking directly to gated content — the reader verifies their access and is immediately redirected to the article.

Migrating members to Access Control

Moving institutional subscribers from WooCommerce Memberships to Access Control? See Institutional access migration templates for ready-to-send member emails.

Still stuck? Post in #newspack-help on Slack.