How We Built a Twitch-Powered Content Security System (3 Years Later, Now on PHP 8+)

TL;DR: We spent three years building a security system that uses Twitch OAuth to lock content behind subscriber and follower tiers. Now integrated with WordPress and Astra, it's production-ready and monetizing.

The Problem We Started With

Three years ago, we faced a challenge: how do you protect exclusive content for paying supporters without building a completely custom authentication system? Every solution felt bloated, expensive, or required maintaining a separate user database.

Then it clicked: Twitch is already our identity provider. Our audience is there. Their subscription tier is there. Follower status is there. Why build something new when we could leverage what exists?

So we built a security layer on top of Twitch OAuth that ties content access directly to subscription and follower status.

The Evolution: PHP 7 → PHP 8+

When we started, we were on PHP 7.4. The original system worked, but we knew we'd need modern tooling to scale.

Last year, we upgraded to PHP 8+, and it was transformative:

Why PHP 8+ Mattered

• Type declarations — We could now enforce strict types across our OAuth callbacks and credential handling
• Named arguments — WordPress option functions became clearer and less error-prone
• Match expressions — Tier logic (follower → tier1 → tier2 → tier3) became cleaner
• Nullsafe operator — Session variables and API responses handled more safely
• Performance — 20-30% faster execution on average

The upgrade also meant better security. OAuth token exchanges and password-protected credential storage benefited from PHP 8's stricter memory handling and default security flags.

How It Works: The Architecture

1. Twitch OAuth Flow

When a user hits your login page:

1. They click "Login with Twitch"
2. Redirect to Twitch OAuth consent screen
3. User approves access
4. Twitch redirects back with an auth code
5. We exchange the code for an access token
6. We query Twitch Helix API for:
   • User profile (username, email, profile image)
   • Subscription status (tier level: 1000, 2000, 3000)
   • Follower status

2. Session & Database Storage

We store:

• Session variables (username, display name, tier level)
• Database record (one entry per login with timestamp, IP, user agent)
• HTTP-only cookies for fallback auth

3. Content Gating

On the frontend:

IF user is admin → show ALL content
ELSE IF user has no subscription → show follower-only content
ELSE IF user is tier1 → show tier1 + follower content
ELSE IF user is tier2 → show tier1, tier2 + follower content
ELSE IF user is tier3 → show everything except admin-only posts

WordPress + Astra Integration

We didn't want to reinvent the wheel. Instead, we built on WordPress + Astra because:

• WordPress handles content management (posts, pages, metadata)
• Astra provides a clean, fast foundation
• Custom post type (tier-content) lets us tag each post with a tier level
• Meta boxes in the admin make tier assignment effortless

The Setup

1. Admin Settings Page — Settings → Twitch OAuth
   • Input Client ID & Secret
   • Set Redirect URI
   • Store channel owner username
   • Save broadcaster ID
2. Custom Post Type — "Tier Content" posts with tier-level meta
3. Template System — Single page template that handles all content gating

No plugin dependency hell. Just clean PHP + WordPress hooks.

Security: Why Twitch Is Your Friend Here

We considered rolling our own auth system. Here's why Twitch OAuth is actually more secure:

1. Offloaded Credential Storage

We never store passwords. Twitch does. We only store access tokens (short-lived, revocable).

2. HTTPS by Default

All Twitch API calls use TLS 1.2+. Your redirect URI must be HTTPS.

3. Scope-Based Permissions

We only request user:read:email and subscription data. Users see exactly what we're asking for.

4. Session Destruction on Logout

We aggressively clear:

• PHP session data
• All cookies (including WP session cookies)
• Browser cache headers
• HTTP 303 redirect (not GET-based)

5. Tier-Content Post Protection

If someone tries to access a tier-content post directly:

• Bots (Googlebot, etc.) see the full content for SEO
• Unauthenticated users get redirected to login
• Authenticated users see only their tier's content
• Admins see everything

The Real-World Impact: Monetization

Here's what matters: this system lets you monetize immediately.

When a Twitch viewer subscribes or follows your channel, they instantly get access to locked content on your site. No manual approval. No separate user database to maintain. No waiting period.

We've seen:

• Tier 1 subscribers access exclusive guides and early-release content
• Tier 2 subscribers unlock premium streams and behind-the-scenes footage
• Tier 3 subscribers get VIP-only posts and direct communication channels
• Followers see teaser content that encourages subscription

The conversion is automatic. Twitch's payment processing handles the business logic. We just gate the content.

Technical Highlights (PHP 8+)

Password-Protected Credentials

<input type="password" id="twitch_client_id" name="twitch_client_id" />
<input type="password" id="twitch_client_secret" name="twitch_client_secret" />

Both fields are now masked in the WordPress admin. No credential sprawl.

Case-Insensitive Username Matching

if (strtolower($logged_in_username) === strtolower($channel_owner)) {
    $is_admin = true;
}

Twitch usernames are lowercase in the API, but admins might enter "SolarBluSeth". We handle it.

Helper Functions (DRY)

function get_twitch_credentials() {
    return [
        'CLIENT_ID' => get_option('twitch_client_id', ''),
        'CLIENT_SECRET' => get_option('twitch_client_secret', ''),
        'REDIRECT_URI' => get_option('twitch_redirect_uri', home_url('/twlogin/')),
    ];
}

No hardcoded values. No credentials.php file sprawl. Just WordPress options.

Aggressive Logout

if (isset($_POST['logout']) && $_POST['logout'] === '1') {
    $_SESSION = [];
    session_destroy();

    $cookies_to_clear = ['sbnet_userid', 'PHPSESSID', 'wordpress_logged_in_...'];
    foreach ($cookies_to_clear as $cookie) {
        setcookie($cookie, '', time() - 3600, '/');
    }

    header('Cache-Control: no-store, no-cache, must-revalidate, max-age=0');
    wp_redirect(home_url('/twlogin/'), 303);
    exit;
}

No lingering session data. No cached pages serving stale content.

What's Next

We're exploring:

1. Conditional email sends — Notify tier1+ subscribers of new content
2. Content analytics — Track which tiers engage with which posts
3. Tier-exclusive comments — Locked discussion threads per tier
4. API integration — Let developers build on top of this

For Streamers & Content Creators

If you stream on Twitch and want to monetize your site:

1. Go to Twitch Developer Console
2. Create an application
3. Set your OAuth Redirect URI to https://yoursite.com/twlogin/
4. Copy your Client ID & Secret
5. Go to WordPress Settings → Twitch OAuth
6. Fill in your credentials and channel owner username
7. Create posts, tag them with tier levels
8. Done.

Your Twitch subscriptions now gate your website content. Automatically.

The Three-Year Lesson

We spent three years on this because we refused to compromise on:

• Security — No shortcuts with auth
• User experience — Login should take 10 seconds
• Maintainability — No spaghetti code
• Scalability — Should handle 10K concurrent users without breaking

PHP 7 → 8+ upgrade forced us to refactor for modern standards, and the result is cleaner, faster, more secure code.

If you're a creator sitting on Twitch subs and thinking "how do I monetize my website?"—this is the answer. Twitch is your security layer. WordPress is your CMS. Astra is your theme. Put them together, and you've got a system that took us three years to perfect.

Now you can build it in a day.

Questions? Hit us up. We've learned a lot, and we're happy to share.

What's Next: The Roadmap

We're currently validating this system on solarbluseth.com and actively building out the next phase. Here's what's in flight:

Phase 1: Revenue Diversification (Now)

• CashApp Tipping Integration — Direct support channel for viewers who want to tip. Coming with time-gated exclusive downloads to drive conversions.
• Admin Dashboard Expansion — Login history, subscriber statistics, content performance by tier, and engagement tracking tabs.
• Time-Sensitive Downloads — Subscribers unlock exclusive content (tracks, files, guides) for limited windows, creating urgency and repeat visits.

Phase 2: The Product (6 Months Out)

We built this for ourselves. Now we're scaling it for creators who want the same setup:

• WordPress Multisite Architecture — One managed network, custom domains point to individual creator instances.
• Managed Updates & Infrastructure — We handle PHP upgrades, security patches, performance monitoring.
• Plug-and-Play Onboarding — Connect your Twitch channel, set tier levels, start gating content. No custom development required.

The Admin Experience: Seeing What's Working

The user-facing side is clean and simple. But on the backend, you get real visibility into what's happening:

Dashboard Tabs

• Login History — Every successful OAuth login: username, tier, timestamp, IP, device
• Subscriber Statistics — Breakdown by tier level, active vs. inactive, engagement patterns
• Content Performance — Which posts get the most views from which tiers
• Conversion Tracking — How many free visitors convert to followers, followers to tier1 subs, etc.

This isn't just nice-to-have visibility—it's the data you need to understand what content resonates with each tier and optimize your monetization strategy.

Three Revenue Streams (Not Just One)

The original post focused on Twitch subscriptions. But we're building a diversified revenue model:

1. Subscription Revenue (Recurring)

Tier 1, 2, 3 subs from Twitch. Payment processing handled by Twitch. Content access automatic. This is the foundation.

2. Tipping (Impulse Support)

CashApp integration lets supporters tip directly. Lower friction than subscribing. Great for one-time supporters or people who love a specific video.

3. Time-Gated Exclusive Content (Urgency-Driven)

Limited-window downloads (tracks, guides, behind-the-scenes) for tippers and tier subscribers. Creates repeat visits and reasons to come back. Example: "Tier 2+ gets the Spiral EP stems for 48 hours only."

Combined, this gives you multiple levers to pull. One audience. Three ways they can support you.

Beyond Your Channel: The Product Roadmap

We spent three years perfecting this for solarbluseth.com. Now we're preparing to offer it to other creators.

Why This Matters

Every Twitch streamer with a website faces the same problem: "How do I monetize without building a custom auth system?" We solved it. Most don't have time to.

The Multisite Play

Instead of managing 100 separate WordPress installs, we run one Multisite network. Each creator points their domain at their instance. They control their content, subscribers see their branding, we handle infrastructure.

What Creators Get

• Twitch OAuth + tier-based gating (built, tested, battle-hardened)
• Admin dashboard with analytics (login stats, tier performance, content insights)
• CashApp tipping integration (set up and forget)
• Automated updates and security patches
• Their own domain, their own branding, their own community

We handle the infrastructure. They focus on content.

🚨 WordPress Threat Monitoring That Actually Works

Real-Time Geolocation Security, Permanent IP Blocking, and Zero Setup Bloat — The Alternative to Wordfence

The Problem: Monitoring Isn't Negotiable

You can have the best firewall in the world, but if nobody's watching, the attacks still get through. Most WordPress breaches happen because site owners didn't see the threat coming, not because their defenses were weak.

Wordfence has solved this with features—lots of them. But feature bloat is a feature problem. More complexity means slower setup, harder troubleshooting, and more things to misconfigure.

What if you just... watched? Real-time. Permanent blocks. No expired temp bans. No complex setup.

What We Built (And Why It's Different)

Advanced Themer 13's traffic monitoring system is built on one principle: you can't respond to threats you don't see.

vs Wordfence: Why Permanent Beats Temporary

The difference: Wordfence asks "what did we catch?" Our system asks "what do we need to watch?"

How Real-Time Monitoring Stops Attacks

Attack #1: Credential Stuffing

Attacker runs bot from 3 different countries, trying 1000 password combos/hour. You see it immediately. Geographic anomaly? Block the country. Pattern clear? Blacklist the IPs. Done before they get in.

Attack #2: Targeted Reconnaissance

Attacker probes for vulnerabilities from their home IP. Your system logs geolocation. You see a spike from one country scanning your admin panel. Permanent block. They can't come back without spoofing.

Attack #3: Distributed Attack Wave

10 IPs from 5 countries suddenly hammering your site. Wordfence temp-bans them; they rotate IPs in 24 hours. Your system blocks the countries. They can't rotate their way out of geography.

Honeypots: Self-Reporting Bad Actors

The most sophisticated layer of threat monitoring is the honeypot. Fake endpoints that look vulnerable but log everything. Every attacker that hits a honeypot self-identifies:

• Fake admin pages (/wp-admin-bak/, /admin.php)
• Known vulnerable endpoints (/?s=<script>)
• Credential forms that don't work

Honeypot hit = confirmed attacker. Geolocation data attached = full intelligence profile. This is how you build threat profiles, not just block threats.

The Privacy & Compliance Piece

Geolocation monitoring is data collection. We handle this with:

• Privacy Policy Coverage - Updated abuse clause explains geolocation tracking for security
• GDPR Compliance - Data retention policies, country blocking for consent management, audit logs
• Transparent Logging - You see exactly what's blocked and why
• No Third-Party Sharing - Your data stays on your server (unlike cloud-based competitors)

This turns geolocation from a compliance liability into a security advantage. You're not spying—you're securing.

The Numbers: 7 Sites, Real Data

These aren't theoretical numbers. This system is live on 7 production WordPress sites right now, blocking threats 24/7 without any human intervention required.

What Makes This Actually Better

Next-Level Threat Detection (Roadmap)

The foundation is built. Future enhancements include:

• Behavioral AI: Distinguish credential stuffing from DDoS from reconnaissance
• IP Reputation Scoring: Auto-blacklist IPs scoring above risk threshold
• Firewall Rule Export: Generate nginx/htaccess blocks from your blacklist
• Threat Intel Sharing: Network of sites sharing threat data
• Failed Login Integration: Auto-blacklist IPs after N failed logins

The Bottom Line

Security doesn't work without visibility. Visibility doesn't matter without response. Response means permanent decisions, not expiring temp bans.

Advanced Themer 13's threat monitoring gives you all three. Real-time geolocation visibility + permanent blocking + zero complexity.

Wordfence solves security by adding features. We solve it by watching.