FTW Forum - Replacing a third-party forum with a custom Next.js + Supabase community

FTW Collective was founded by Federico Iossa of FedericoTalksWatches. Members pay for access to a dealer-level marketplace and a community of serious collectors. The marketing site, memberships and marketplace stay in Webflow + Memberstack. The forum and messaging now live at forum.ftwcollective.io.

The plugin was holding the community back. Supersparks had recurring bugs, including replies showing up as "Guest" on gated pages. It couldn't do what the client wanted next: rich text with images in every reply, nested replies, editing your own posts, and likes instead of upvotes. Posts lived in Webflow CMS, where collection limits and slow publishing were already a constraint.

Login had to stay invisible. Members already had Memberstack accounts tied to Stripe plans. Asking them to sign up again was not an option. The catch: Memberstack stores its session in the browser's localStorage on www.ftwcollective.io, which a forum on a different subdomain cannot read.

Not every plan gets access. Members on the VIP Lite plan had to be kept out of the forum and sent to an upgrade page, while every other plan got in automatically.

Year of history had to move. Every thread, comment and reply had to be migrated from a tool with no self-serve export, and old URLs had to keep working.

One person moderates, many people post. The client needed a simple way to remove and restore content without touching a database.

Before building, we evaluated off-the-shelf options, including Discourse. A custom build won because it could match the vBulletin design, reuse Memberstack as the single source of truth for accounts and billing, and give the client full ownership of the data.

Single sign-on with Memberstack. I built a small bridge page on the Webflow site. A logged-in member is handed to the forum with their Memberstack token, the forum verifies it server-side, checks the member's plan, and creates its own secure httpOnly session. Members never see a second login. Redirects are restricted to a whitelist, and inactive memberships are blocked.

Plan-based access. Access rules are checked on the server for every request. VIP Lite members are redirected to a dedicated upgrade page instead of seeing an error.

Database security by design. The forum runs on Supabase Postgres with Row Level Security on every table. Every write goes through server-side actions where the author's identity comes from the session, never from the browser, so members cannot post as someone else or edit content that isn't theirs. Public anonymous access to forum tables is revoked entirely.

Protected from scrapers. The forum is hosted on Vercel with firewall rules that block AI crawlers and scrapers, so members-only discussions stay members-only.

Forum features.

• Topics, threads, nested replies and likes

• Rich text editor (Tiptap) with image uploads, content stored as structured JSON

• Edit and delete your own posts (soft delete, so moderators can restore)

• Realtime comments: new replies appear without refreshing

• Unread indicators on topics and threads

• Member profile pages with Posts and Comments tabs

• Email notifications sent from a dedicated subdomain, kept separate from business email and the newsletter

Private messages. One-to-one messaging built into the same app, replacing Memberchat, so members have one place for discussion and contact.

Search. Postgres full-text search across thread titles, opening posts and every reply, powered by generated search columns so the index stays up to date automatically. Results show the matching snippet highlighted. Before going live, I verified it with a SQL test harness of [21] search cases.

Moderation panel. A private panel for three accounts, listing all posts and comments with Remove and Publish buttons. New content stays auto-published, so moderation never slows the community down.

Migration. I wrote Node scripts to import the full Supersparks export into Postgres and then verify the result against the source. Any item the old tool had exported broken was skipped rather than patched, which avoided carrying old bugs into the new system. A final delta sync ran two days before launch, and every old forum URL redirects to its new location. After launch, Supersparks was fully removed: webhooks off, old pages taken offline, old data archived.

Tech stack

• Frontend: Next.js (App Router), React, TypeScript, Tailwind CSS

• Editor: Tiptap, content stored as JSON

• Database and backend: Supabase (Postgres, PostgREST, Row Level Security, PL/pgSQL functions, full-text search, Realtime)

• Auth: Memberstack via a Webflow bridge page, httpOnly session cookie, custom-signed Supabase JWT

• Main site: Webflow (marketing, memberships, login)

• Hosting: Vercel, with firewall rules and AI bot blocking

• Migration: Node scripts for import and verification

• Email: MailerSend, on a dedicated notifications subdomain

The new forum went live on September 30, 2026. 593 threads and 6382 comments were migrated, and members logged in with their existing accounts on day one.

• One login across the whole platform, with Memberstack and Stripe still the single source of truth

• Features the old plugin couldn't provide: rich text and images, nested replies, quoting, editing, likes, realtime updates, search

• Messaging and forum in one place, replacing two separate paid tools

• All community data in a Postgres database the client controls

The first version of FTW Collective showed how far Webflow and no-code tools can go: launched in 4 weeks, $1.48M in sales. This phase shows what to do when one part of the platform outgrows them. Instead of rebuilding everything, we replaced only the part that needed custom code and kept the rest in Webflow, where the team can still edit it themselves. Read the first version case study.

If your Webflow + Memberstack site has outgrown a plugin, whether a forum, chat, member directory or dashboard, reach out at hello@maksimovicdanijel.com or on UpWork.