What happens when a sale, a campaign, or a viral post sends more visitors than your server can comfortably handle?

GIL Waiting Room creates a virtual waiting room in front of your site. You choose how many visitors may browse at the same time; everyone above that limit is placed in a fair, first-come-first-served queue and sees a clean lobby page with their live position and an estimated wait. As soon as a spot opens, the next visitor in line is admitted automatically, no refresh or action needed.

How it works

Each visitor gets a signed, HttpOnly cookie so their place in line survives reloads and short absences.
Admission is atomic at the database level, so the limit holds even under bursts of concurrent traffic.
Admitted visitors keep their spot for a session length you configure; when it expires, the spot goes to the next person in line.
The lobby page polls a lightweight status endpoint every few seconds, shows live progress, and lets the visitor in the moment they are admitted.
The lobby adapts to the visitor’s light or dark system theme, respects reduced-motion preferences, and announces progress to screen readers.
Preview the waiting room from the settings page before enabling it, and watch live admitted/waiting counts during a spike.
The lobby is served with HTTP 503 and a Retry-After header, so search engines understand the site is temporarily busy and do not index the lobby.
Administrators are never gated, so you cannot lock yourself out.

What this plugin is not

GIL Waiting Room manages capacity, it is not DDoS protection. Requests still reach PHP; the plugin decides who may browse. If you are under attack, you need protection at the network or CDN layer.

If a full-page cache or CDN serves your pages without hitting PHP, those cached hits cannot be queued. The waiting room works for requests that reach WordPress.