Turn your WordPress content and downloads into leads.

GWiz IT Content Locker lets you place pages, downloads, sections of content, or individual page elements behind a customizable signup form.

Visitors enter their information to unlock your content, giving you a simple way to grow your email list, offer lead magnets, protect downloads, and measure conversions directly from WordPress.

The plugin is free and self-hosted. No third-party SaaS service is required to use the content locker or store your signups.

Want to use an existing email marketing platform? Confirmed subscribers can optionally be synced automatically to Mailchimp, Brevo, ConvertKit, ActiveCampaign, or phpList.

Watch It In Action

GWiz IT Content Locker — demo video

What Can You Lock?

Pages and Posts — Gate an entire WordPress page or post by URL.
File Downloads — Require visitors to sign up before accessing protected files.
Sections of Content — Wrap selected content in a simple shortcode.
Page Elements — Lock specific elements using CSS selectors.
Popup Offers — Open a signup gate from a custom link anywhere on your site.

Great For

Lead magnets
PDF and document downloads
Free guides and checklists
Resource libraries
Bonus content
Email list building
Gated articles or page sections
Downloadable marketing materials
Members-only style resources without requiring a full membership plugin

How It Works

Create a Restricted Area in WordPress.
Choose what you want to protect.
Customize your signup form and unlock message.
Visitors complete the form to gain access.
View signups and conversion statistics in WordPress or optionally sync subscribers to your email marketing platform.

You can create multiple Restricted Areas, each with its own protected content, form, styling, settings, integrations, and subscriber list.

Lead Capture & Content Gating

Multiple Restricted Areas — Create separate gates for different downloads, pages, campaigns, or content.
Custom Form Builder — Build signup forms with drag-and-drop fields and 9 available field types. The email field is always required.
Inline Shortcodes — Gate only part of a page using [gwiz_it_content_locker].
Full-Page Gating — Protect an entire page or post by URL.
Protected Downloads — Require signup before visitors can access gated files.
CSS Selector Gating — Lock specific page elements without changing your page layout: show a customisable sign-up placeholder, or keep the classic visual lock.
Popup Trigger Links — Open a content-locker popup from a custom anchor link.
Double Opt-In — Optionally require email confirmation before granting access.
Already Signed Up Verification — Returning subscribers can verify their email and regain access.

Forms & Styling

Visual Form Builder — Create custom signup forms without coding.
Custom Email Templates — Edit confirmation and congratulations emails.
Custom Popup Templates — Control the message visitors see before unlocking content.
Style Presets — Quickly apply predefined form and popup styles.
Custom Colors & Typography — Adjust form appearance to match your website.
Custom Borders — Configure form and popup border width and color.
Custom CSS — Add styles scoped specifically to an individual form or popup.
Built-In Preview — Preview form and popup states before publishing.

Subscriber Management & Analytics

Signups Viewer — View and search collected subscribers from WordPress.
Customizable Columns — Choose which signup information is displayed.
CSV Export — Export subscriber information for Excel or other tools. Large lists stream in batches.
Data Retention — Automatically anonymise visitor IPs and purge old statistics on a daily schedule.
Conversion Statistics — Track views, submissions, confirmations, and conversion performance.
Date Filtering — Review statistics for specific date ranges.
Clone Restricted Areas — Duplicate an existing campaign with one click.
Export & Import — Back up or move Restricted Area settings between WordPress sites.
Optional Contact Migration — Include subscriber records when cloning, exporting, or importing Restricted Areas.

Email Marketing Integrations

Confirmed signups can optionally be sent automatically to:

ActiveCampaign — Add contacts to a list with optional tags.
Brevo (formerly Sendinblue) — Add contacts to a list.
ConvertKit — Add subscribers to a sequence or tag.
Mailchimp — Add subscribers to an audience with optional tags.
phpList — Add subscribers to a self-hosted phpList mailing list.

These integrations are optional.

You can use GWiz IT Content Locker entirely within WordPress without connecting an external email marketing service.

Spam Protection

Choose the spam-protection method that works best for your site:

Google reCAPTCHA v2 — Traditional checkbox CAPTCHA.
Google reCAPTCHA v3 — Invisible score-based spam protection.
ALTCHA — Self-hosted, privacy-friendly proof-of-work CAPTCHA with no external API calls.

Works With Popular Page Builders

GWiz IT Content Locker supports content created with:

Elementor
Divi
Beaver Builder
Standard WordPress content

The plugin detects gated content inside supported page-builder data and only loads its frontend assets when they are needed.

Privacy & Self-Hosted Data

GWiz IT Content Locker stores signup information on your WordPress website.

No subscriber information is sent to an external email marketing service unless you configure and enable that integration.

The plugin integrates with the WordPress privacy tools: signups appear in Tools Export Personal Data, and Tools Erase Personal Data removes the visitor’s email, form answers, source URL and IP address (an anonymised record is kept so your statistics stay accurate) and asks each connected email service to delete the contact. Suggested privacy-policy text is provided under Tools Privacy.

Gate activity is kept bounded and privacy-friendly on an automatic schedule: visitor IP addresses are anonymised after 30 days and old events are deleted after 365 days by default (both configurable under Settings Data Retention).

If you prefer not to use an external CAPTCHA service, the built-in ALTCHA option is fully self-hosted and does not make external API calls.

Built for WordPress

Gated content is not sent to unauthorised visitors: shortcode content, CSS-selector elements, and protected files are withheld server-side and only delivered after eligibility is re-verified on the server. Nothing is “hidden with JavaScript only”.
File downloads require a short-lived, single-use download ticket that is issued only after the server confirms the visitor’s access — a download link on its own never serves the file.
Frontend JavaScript and CSS load only on pages where they are needed.
Visitor access cookies are HMAC-signed.
Each Restricted Area can have its own cookie expiration.
Logged-in users automatically bypass gates while editing the site. File downloads additionally require a role with edit capability (customizable via the gwiz_it_content_locker_bypass_logged_in filter).
Rate limiting and input size caps protect all visitor-facing signup, confirmation, verification, unlock, and download endpoints.
Debug Mode lets administrators preview and test gates while logged in.
Built-in help explains each major setting in plain English.
Restricted Areas can be exported and imported for backup or migration.
Developer filters are available for advanced integrations and customization.

Shortcode Usage

Gate content inline using the shortcode:

[gwiz_it_content_locker area="AreaName"]This content is hidden until the visitor signs up.[/gwiz_it_content_locker]

The area attribute uses the Restricted Area’s display name.

The exact shortcode for each area is shown in the area’s Settings modal with a Copy button.

If multiple areas share the same name, automatic name deduplication is applied: AreaName, AreaName2, AreaName3, etc.

Important — logged-in users normally do not see the gate.

If you are logged in as an administrator or another WordPress user, the plugin intentionally shows the unlocked content without requiring signup.

This prevents site administrators and editors from being locked out of their own content.

To test the gate as a normal visitor:

Log out of WordPress, or
Open the page in a private/incognito browser window.

Administrators can also enable Debug Mode in the Restricted Area settings to preview the gate while logged in.

Developers can adjust logged-in bypass behavior with the gwiz_it_content_locker_bypass_logged_in filter.

External Services

GWiz IT Content Locker optionally connects to third-party services when configured by the site administrator.

No data is sent to these services until the administrator explicitly enables the integration and provides the required credentials.

ActiveCampaign — Syncs confirmed subscriber email addresses to your ActiveCampaign account through its API. (ActiveCampaign Privacy Policy)
Brevo (formerly Sendinblue) — Syncs confirmed subscriber email addresses to your Brevo account through its API. (Brevo Privacy Policy)
ConvertKit — Syncs confirmed subscriber email addresses to your ConvertKit account through its API. (ConvertKit Privacy Policy)
Mailchimp — Syncs confirmed subscriber email addresses to your Mailchimp audience through its API. (Mailchimp Privacy Policy)
phpList — Syncs confirmed subscriber email addresses to your self-hosted phpList installation through its REST API.
Google reCAPTCHA — When enabled, loads Google reCAPTCHA to protect signup forms from spam. Google may receive information including the visitor’s IP address and browser information for verification. (Google Privacy Policy)

All external data transfers occur over HTTPS.

The ALTCHA CAPTCHA option is fully self-hosted and does not connect to an external CAPTCHA service.

Hooks

Filters

gwiz_it_content_locker_load_frontend

Controls whether GWiz IT Content Locker frontend assets load on the current page.

Example:

add_filter( 'gwiz_it_content_locker_load_frontend', function( $should_load, $post ) {

    // Force-load on a specific page template.
    if ( is_page_template( 'template-custom.php' ) ) {
        return true;
    }

    // Prevent loading on the shop page.
    if ( is_shop() ) {
        return false;
    }

    return $should_load;

}, 10, 2 );

Parameters:

$should_load (bool) — Whether frontend assets should load. The default is automatically determined based on shortcode or selector presence.
$post (WP_Post|null) — The current post object.

gwiz_it_content_locker_bypass_logged_in

Allows developers to modify the default behavior that lets logged-in WordPress users bypass content gates.

By default, logged-in users are not required to complete signup forms. File downloads are stricter: the default there requires a role with edit capability, so ordinary subscribers do not receive gated files.

Parameters:

$bypass (bool) — Whether logged-in users bypass the gate (the download endpoint passes current_user_can( 'edit_posts' ) as this default).
$area_id (int) — The Restricted Area ID.
$settings (array) — The area’s parsed settings.

Actions

gwiz_it_content_locker_caches_cleared

Fires after the plugin cleared site caches following a Restricted Area save (see Settings Cache Clearing).

$cleared (bool) — Whether a known cache plugin or host cache was cleared. Use this to hook in your own cache/CDN purge.

gwiz_it_content_locker_retention_run

Fires after a daily data-retention pass (see Settings Data Retention).

$stats (array) — Rows processed in the pass: tickets_purged, ips_anonymised, events_deleted.