What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
WordPress content locking is not one feature. Decide what should unlock the material—one shared password, an email submission, a logged-in role, a payment, or a date—then use the simplest mechanism that enforces that rule. WordPress’s built-in password visibility is sufficient for a private post shared with a known group; email, membership, paid and drip-access gates require purpose-built plugins and testing beyond the editor.
Choose the type of content lock first
Write the access rule in one sentence before installing a plugin. For example: “Anyone with this password can read the page,” “a visitor submits an email and then sees the guide,” or “lesson two opens seven days after registration.” The WordPress.org content-locker directory groups these as different functions, not as one universal feature.
| # | Preview | Product | Price | |
|---|---|---|---|---|
| 1 |
|
WishList Member Plugin Owner's Guide (Making Money With WordPress) | $6.99 | Buy on Amazon |
| Requirement | Suitable approach | What it does not automatically provide |
|---|---|---|
| One password for a small, known audience | WordPress post or page password visibility | Separate accounts, payments or per-user permissions |
| Email before reading or downloading | Email-gating plugin such as Inklatch | A complete membership or billing system |
| Different content for logged-in users or roles | Access-control or membership plugin such as Restrict User Access | Protection of every archive, API response or original file URL by default |
| One-time payment or subscription | Paywall/membership plugin with a payment gateway, such as PostGate | A working payment account without gateway and webhook configuration |
| Release on a calendar date or after registration | Date or drip-access plugin such as Content Time Lock | Payment processing, email opt-ins or membership tiers |
| File available after a form submission | Gated-download function | Protection of the file itself from a copied or guessed URL |
Option 1: Password-protect a post or page with WordPress core
Use the built-in visibility control when every approved reader can use the same password and you do not need individual accounts. Edit the post or page, open its publishing or status/visibility settings, choose password protection, enter the password, and update or publish. The exact panel label can vary by WordPress version and editor.
Open the public URL in a logged-out browser to confirm that WordPress shows a password form instead of the protected body. This method is intentionally simple: it does not create a customer record, charge a fee, verify an email address or release lessons on a schedule. Anyone who knows the shared password has the same access until you change it.
Free tools Windows power users keep installed
One-click scans. No signup required.
Option 2: Lock content behind an email form
An email gate is appropriate when the visitor should submit an address before receiving an article, resource or download. Select a plugin that explains whether the protected body is withheld from the initial HTML or merely hidden after the page loads. The Inklatch listing states that its gated body is fetched after unlock, supports an optional public excerpt and describes schema.org paywalled-content markup; those are vendor claims that should be verified on your site.
Configure the gate
- Install and activate the email-gating plugin from Plugins > Add New, or upload its approved package.
- Choose the post, page, block or download to protect.
- Set the form fields, success action and locked-state message. Tell visitors what they receive and how their address will be used, and apply the privacy requirements relevant to your audience.
- Decide whether a short excerpt remains public for sharing and search. Do not assume an excerpt setting protects the rest of the content.
- Submit the form as a logged-out visitor and verify that the unlocked response works through your cache and CDN.
Full-page caching can be compatible with some implementations because every visitor initially receives the same locked HTML, but a CDN may cache responses differently. Test the actual response headers and rendered output rather than relying on a plugin label.
Option 3: Restrict content to accounts, memberships or roles
Use role-based access when readers need their own accounts or different groups should see different material. A typical workflow is to create an access level, define its conditions, assign the qualifying WordPress role or membership, and attach that level to a post, page, category or block.
Check the plugin’s default scope carefully. The Restrict User Access listing says its restrictions do not automatically cover archives, search results, widgets, REST API output or custom lists, and that deep-linked files are not supported. A visitor blocked on the article page may therefore still discover a title, excerpt, API record or file unless you configure those surfaces separately.
Recommended Free Tools
Protect the complete delivery path
- Post or page URL, including logged-out output.
- Category, tag, author and search archives.
- Widgets, menus, related-post blocks and REST API responses where applicable.
- Images, PDFs, videos and other original media URLs.
- Feeds, social previews and cached copies that your site intentionally exposes.
Option 4: Add a paid article or subscription paywall
A paid gate must connect checkout, payment confirmation and access revocation—not just hide a paragraph. PostGate’s documented workflow describes selected post/page or block restrictions, login gates, one-time payments, recurring subscriptions and Stripe integration.
Typical PostGate/Stripe setup sequence
- Enable HTTPS on the WordPress site and allow WordPress user registration.
- Install the paywall plugin and connect Stripe using its current settings screen.
- Create or synchronize the prices and choose whether each product is one-time or recurring.
- Configure the Stripe webhook so successful payments and subscription status can reach WordPress.
- Assign the product to the required post, page, block or taxonomy restriction.
- Complete a test purchase, then test login, logout, renewal, cancellation and access removal.
- Only after the complete test succeeds, switch the gateway to live processing.
Show the price and whether it recurs before the purchase action. Payment plugins differ in their dashboards and webhook instructions, so follow the current documentation for the specific plugin you deploy.
Option 5: Release lessons on a date or drip schedule
For a fixed launch date, use a date rule. For a course that unlocks lessons a set number of days after each student registers, use a registration-offset rule. Content Time Lock documents both modes and role restrictions, while explicitly stating that it does not process payments, collect email opt-ins or provide membership tiers.
That boundary matters: a separate checkout or membership process must grant the role that qualifies a student for the schedule. Test the schedule with a non-administrator account whose registration date and timezone represent a real learner.
Lock a download, not only its button
A form that reveals a download link can still leave the original PDF, ZIP or media URL publicly reachable. Before launch, copy the final file URL, open it in a private browser and try a guessed or previously shared URL. If the file must be private, use a delivery method that authorizes the file request itself; hiding a button or page section is not equivalent to access control.
Test every route as a real visitor
Administrators can bypass restrictions, so testing only while logged in gives false confidence. Use a logged-out browser and a non-admin test account.
- Load the direct post or page URL and confirm the locked message and form.
- View the HTML source or network response to see whether protected text is present before unlock.
- Check category, tag, author, site-search and related-content listings.
- Query the REST API or feeds if your site or app consumes them.
- Open direct image, document and video URLs without the qualifying cookie or account.
- Repeat the checks through the production cache/CDN, on mobile, and after clearing cookies.
- For paid gates, test failed payments, refunds, cancellations, expired subscriptions and renewed access.
Search, caching and maintenance decisions
Choose deliberately how much locked material search engines and social cards may see. A public excerpt can help discovery, while withholding the full body reduces accidental exposure; the available settings are plugin-specific.
Before installation, review the current WordPress.org listing, changelog, support activity and “tested with” value. Directory compatibility metadata changes over time. Confirm compatibility with your active WordPress version, theme, editor, page builder and cache stack, then retest after major updates.
A practical decision checklist
- Unlock event: password, email, login/role, payment, date or registration offset.
- Scope: whole site, post, category, selected block or file.
- Identity: shared secret, cookie/session, verified email or account.
- Exposure: initial HTML, archives, API, feeds, previews and direct files.
- Billing: none, one-time, recurring, refunds and renewals.
- Operations: cache behavior, privacy notice, monitoring, updates and recovery when a plugin fails.
The Bottom Line
Start with WordPress’s core password visibility for a simple shared-password page. Choose an email, membership, paywall or drip plugin only when that specific unlock rule is required, and verify the locked content, caches, archives, APIs and original file URLs from a logged-out visitor’s perspective.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
