21Million Academy

Where we started

21Million Academy is a finance course platform. It ran on WordPress with LearnDash for courses, BuddyBoss for the community and VdoCipher for protected videos. To make the mobile app work we had already written a bridge plugin, because the LearnDash APIs provided neither user progress nor protected video access.

Every new feature meant one more plugin to update and one more place where something could break. The goal was to remove WordPress without members noticing: same courses, same progress, same password.

What we did

We wrote a Node.js backend with a PostgreSQL database that handles courses, lessons, enrolments, progress, certificates and community. Its APIs mirror those of the bridge plugin one by one: the app only needed to change the server address, with no code changes.

We did not ask for database access to get the data out of WordPress. A script creates a temporary snippet of code on the site, downloads encrypted passwords, enrolments and progress, and then deletes it. The WordPress IDs also stayed the same, so every link and every reference in the app still points to the right resource.

Passwords were not reset. At first login the backend checks the password in the old WordPress format and rewrites it in a more secure format (bcrypt). Users notice nothing.

The public site is in Astro: static pages for the catalogue and course pages, and a members’ area for following lessons. The web server passes API calls to the backend, on the same domain.

During the switch WordPress stayed on in read-only mode, so we could roll back at any moment.

How it’s built

• Node.js and Express backend, PostgreSQL database
• Astro site served by nginx
• VdoCipher videos with a viewing code valid for 5 minutes, requested by the server only for enrolled users
• Moving watermark with the viewer’s email, against account sharing
• Short-lived access tokens and a limit on login attempts
• Community with feed, members, messages and notifications
• Coolify publishes on every code change

Outcome

The site runs on the new system: 47 courses and 849 lessons now live in our own database, together with members and their progress. Paid content is protected at every step: anyone not enrolled on a course receives neither the lesson nor the code to watch the video. Website and app use the same APIs and the same accounts, and the privacy page declared in the app stores has stayed at the same address.