UnlockForge

Protect WordPress content with previews, Social Login, Email Unlock, and paid access through Razorpay.

Version 0.4.0 includes Social Login, Email Unlock, configurable protection modes, custom Unlock Messages, bulk protection, analytics, external identity management, and Razorpay payment integration for sites that want to charge for protected content.

Visitors can authenticate using Google, Facebook, X, LinkedIn, or GitHub, or verify their email address using a one-time code. Site owners can customize the unlock experience, apply protection to multiple items, and review activity through the Analytics dashboard.

UnlockForge is suitable for publishers, membership sites, blogs, educational websites, documentation sites, resource libraries, and other WordPress sites that need controlled access to content.

What can you do with UnlockForge?

• Protect WordPress posts and pages.
• Show a configurable preview before the unlock gate.
• Lock content until the configured unlock requirements are met.
• Offer Social Login through supported OAuth providers.
• Let visitors verify their email using a one-time code.
• Configure paid content using Razorpay.
• Customize unlock gates with titles, messages, images, and emoji.
• Target Unlock Messages by WordPress category and schedule.
• Apply protection settings to multiple posts and pages in bulk.
• Review authentication and content-unlock analytics.
• Manage external authentication identities separately from content-access decisions.

Authentication and entitlement are separate concepts. Logging in alone does not grant access to content that requires a successful payment or another configured entitlement.

Features

Content Protection

Choose one of three protection modes for posts and pages:

• Disabled: Display content normally.
• Preview: Display a configurable portion of the content before the unlock experience.
• Full Lock: Hide protected content until the configured unlock requirements are satisfied.

Preview methods include paragraphs, words, and excerpts. Global preview settings are available, with per-content overrides where supported.

Social Login

Allow visitors to unlock protected content using supported social-login providers:

• Google
• Facebook
• X
• LinkedIn
• GitHub

Configure OAuth credentials from the WordPress admin settings. UnlockForge associates the external identity with a WordPress user account. Multiple external identities can be associated with the same WordPress user, while content-access decisions remain separate from authentication.

Email Unlock

Email Unlock lets visitors verify an email address without using a social-login provider.

The visitor flow is:

1. Enter an email address.
2. Request a verification code.
3. Receive the code by email.
4. Enter the code.
5. Unlock the protected content after successful verification.

Configurable email settings include the OTP email subject, message, expiration, and supported placeholders:

• {{otp}}: The verification code.
• {{expires_in}}: The number of minutes before the code expires.
• {{site_name}}: The WordPress site name.

Email delivery uses the WordPress mail system. Administrators can configure their preferred SMTP plugin or transactional email service.

Paid Content with Razorpay

Version 0.4.0 introduces Razorpay payment integration for sites that want to charge visitors for protected content.

Depending on the site’s configuration and the enabled payment flow, administrators can configure payment credentials, currency, test or live mode, and webhook verification. Payment notifications can use configurable email templates for supported payment outcomes.

A payment must be verified before paid access is granted. Authentication and payment entitlement remain separate: a visitor being logged in does not, by itself, unlock paid content.

Razorpay requires the site owner to have their own Razorpay account and credentials. The site owner is responsible for completing any account verification and onboarding required by Razorpay.

Custom Unlock Messages

Customize the message visitors see when they encounter protected content. Unlock Messages support:

• Custom title and message.
• Emoji and image.
• WordPress category targeting, including multiple categories.
• Start and end dates and times.

Messages can be scheduled and targeted to categories. If no matching message applies, UnlockForge uses the normal content-protection flow.

Bulk Protection

Apply protection settings to multiple existing posts or pages without editing each item individually.

Bulk Protection supports:

• Posts and pages.
• All content or category-based filtering.
• Disabled, Preview, and Full Lock modes.
• Batch processing and progress tracking.

Review the selected content scope and protection mode before starting an operation. Applying a bulk operation may overwrite existing protection settings for the selected items.

Analytics

Review authentication and content-unlock activity from the Analytics dashboard. Available metrics and reports include:

• Unlocks and unique users.
• Successful logins and login failures.
• Login-to-unlock conversion.
• Unlock activity and login providers.
• Top protected content.
• Unlock Message performance.

Available date filters include Today, Last 7 Days, Last 30 Days, Last 90 Days, and a custom date range. Date-range selection uses the WordPress site timezone.

External Identity Management

UnlockForge stores external authentication identity information separately from WordPress user accounts and content-access decisions. This allows a user to associate multiple supported external identities with one WordPress account and supports the plugin’s separate authentication and access-control model.

How It Works

A simplified content-unlock flow:

1. A visitor opens protected content.
2. UnlockForge checks the configured protection mode.
3. If the content is protected, the visitor sees the configured preview or unlock gate.
4. The visitor selects an available unlock method.
5. The visitor authenticates through Social Login, verifies an email address, or completes the configured payment flow where enabled.
6. UnlockForge validates the relevant authentication or payment result.
7. Access is granted according to the configured protection and entitlement rules.

Authentication is not the same as payment entitlement. Paid access must be established independently of whether a visitor has logged in.

Configuration

Open Settings → UnlockForge after activating the plugin.

The settings areas include:

• Preview.
• Social Login.
• Email Unlock.
• Payment.
• Unlock Messages.
• Bulk Protection.
• Analytics.
• About & Help.

The options available depend on the installed plugin version.

Setup Guides

For instructions on configuring Social Login providers, Email Unlock, WordPress email delivery, or Razorpay payments, refer to the relevant setup documentation.

For Razorpay payments, review the official resources below:

• Terms and Conditions: https://razorpay.com/terms/
• Privacy Policy: https://razorpay.com/privacy-policy/
• API key documentation: https://razorpay.com/docs/payments/dashboard/account-settings/api-keys/
• Webhook documentation: https://razorpay.com/docs/webhooks/

Keep OAuth client secrets, payment API secrets, and webhook secrets private.

Security

UnlockForge uses WordPress security mechanisms and validation across its administrative, authentication, and content-unlock flows.

WordPress Security

Security measures include:

• WordPress nonces for protected administrative and AJAX actions.
• WordPress capability checks for administrative operations.
• Sanitization of submitted values.
• Escaping of output.
• Protected handling of provider credentials.

OAuth Security

Social Login uses OAuth state validation to protect the authentication callback flow. The implementation includes server-side state storage, browser-bound nonce validation, single-use state values, and cookie protections such as Secure when HTTPS is enabled, HttpOnly, and SameSite.

OAuth client secrets should never be exposed publicly or included in client-side JavaScript.

Email OTP Security

Email Unlock includes temporary OTP challenges, OTP expiration, hashed OTP storage, browser-bound verification challenges, email-based and IP-based rate limiting, WordPress nonce validation, server-side content-context resolution, and challenge consumption during verification.

OTP values are not stored as plaintext in the temporary verification challenge. Rate limiting helps reduce repeated requests and automated abuse.

Payment Security

For Razorpay payments, configure the correct API credentials and webhook secret for the selected mode. Keep secrets private and test payment flows before accepting live transactions. Do not treat a browser redirect or client-side message alone as proof of payment. Paid access should depend on verified payment state.

Server-Side Content Context

UnlockForge resolves the content context server-side before creating an Email Unlock challenge. This helps prevent a visitor from changing a client-side content identifier to associate a verification flow with unrelated protected content.

Privacy and Data Handling

UnlockForge may store information needed to associate authentication identities with WordPress users, record analytics, process payment status, and manage paid-content entitlement where those features are enabled. The exact data depends on the authentication method, payment configuration, and site setup.

UnlockForge provides privacy erasure handling for stored identity information and anonymizes associated analytics user references where applicable. Site administrators are responsible for configuring their privacy policy and disclosures for enabled authentication methods, analytics, payment processing, and third-party services.

Unlock Messages

Unlock Messages allow site administrators to customize the experience visitors see when they encounter protected content. A message can include a title, message, emoji, image, categories, start date, and end date. Messages can target specific WordPress categories and be scheduled for specific periods.

When multiple messages match the same content, UnlockForge uses the applicable message based on its matching and scheduling rules.

Analytics

UnlockForge records authentication and content-unlock events to provide visibility into protected-content activity. Events include Login Started, Login Successful, Login Failed, and Content Unlock.

Login failures are grouped by failure reason to help administrators identify authentication issues. The Analytics dashboard provides activity information and aggregated metrics such as unique users and login-to-unlock conversion.

Bulk Protection

Bulk Protection lets administrators apply settings to multiple existing posts and pages. Select posts or pages, all content or selected categories, and Disabled, Preview, or Full Lock. Operations are processed in batches and display progress while running.

Applying a bulk operation may overwrite protection settings for the selected items. Review the scope and mode before starting.

Testing and Troubleshooting

If an authentication or payment flow does not work as expected, verify the relevant settings and credentials, check the provider’s configuration, and review your WordPress and server logs.

For provider-specific troubleshooting steps, refer to the UnlockForge documentation and the relevant provider’s official documentation.

Privacy

UnlockForge may store information required to associate external social-login identities and email-based authentication with WordPress users. Where payment features are enabled, payment-related identifiers, amounts, currency, statuses, and entitlement information may also be processed or stored as needed to manage transactions and paid access.

Analytics may store authentication and content-unlock activity for reporting. UnlockForge provides privacy erasure handling for stored identity information and anonymizes associated analytics user references where applicable.

Site administrators are responsible for updating their privacy policy and disclosures to describe the data collected through enabled authentication methods, analytics, Razorpay, and any configured email delivery providers.

External Services

UnlockForge contacts third-party services when the corresponding feature is enabled and used. These services may process information needed to authenticate a visitor, deliver verification email, or create and verify payment transactions.

Google

UnlockForge uses Google OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to Google may include OAuth authorization requests and the authorization code used during the flow. Data received may include a Google account identifier, name, email address, and profile information permitted by the configured OAuth scopes. Google is contacted when a visitor chooses Google as their login provider.

Terms of Service: https://policies.google.com/terms
Privacy Policy: https://policies.google.com/privacy

Facebook

UnlockForge uses Facebook Login to authenticate users and retrieve account information required for authentication and identity association.

Data sent to Facebook may include OAuth authorization requests and the authorization code used during the flow. Data received may include a Facebook user identifier, name, email address, and profile information permitted by the configured permissions. Facebook is contacted when a visitor chooses Facebook as their login provider.

Terms of Service: https://www.facebook.com/legal/terms
Privacy Policy: https://www.facebook.com/privacy/policy

LinkedIn

UnlockForge uses LinkedIn OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to LinkedIn may include OAuth authorization requests and the authorization code used during the flow. Data received may include a LinkedIn member identifier, name, email address, and profile information permitted by the configured scopes. LinkedIn is contacted when a visitor chooses LinkedIn as their login provider.

Terms of Service: https://www.linkedin.com/legal/user-agreement
Privacy Policy: https://www.linkedin.com/legal/privacy-policy

X

UnlockForge uses X OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to X may include OAuth authorization requests and the authorization code used during the flow. Data received may include an X user identifier, name, username, and email address when available through the configured permissions. X is contacted when a visitor chooses X as their login provider.

Terms of Service: https://x.com/en/tos
Privacy Policy: https://x.com/en/privacy

GitHub

UnlockForge uses GitHub OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to GitHub may include OAuth authorization requests and the authorization code used during the flow. Data received may include a GitHub user identifier, name, username, and email address. GitHub is contacted when a visitor chooses GitHub as their login provider.

Terms of Service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service
Privacy Statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

Email Delivery

Email Unlock uses the WordPress mail delivery system to send verification emails. UnlockForge does not require a specific email provider. Site administrators can configure WordPress email delivery using an SMTP plugin or transactional email provider.

The configured email delivery provider may process the recipient email address, email subject, email message, and verification code contained in the email. Administrators should review the terms and privacy policy of their configured provider.

Razorpay

When Razorpay payments are enabled and used, UnlockForge communicates with Razorpay to create or verify payment transactions and receive payment webhook notifications.

Depending on the payment flow, information sent to or received from Razorpay may include order or payment identifiers, amount, currency, transaction status, and related payment metadata. Razorpay is contacted when a visitor initiates or completes a payment flow, or when Razorpay sends a configured webhook.

Terms and Conditions: https://razorpay.com/terms/
Privacy Policy: https://razorpay.com/privacy-policy/
API key documentation: https://razorpay.com/docs/payments/dashboard/account-settings/api-keys/
Webhook documentation: https://razorpay.com/docs/webhooks/

Planned / Future

Potential future improvements may include:

• Additional payment providers.
• Expanded membership and entitlement options.
• Additional access methods.
• Expanded analytics and event tracking.
• A configurable “Pay once, see all” access option.

These are potential future enhancements and should not be interpreted as features currently available unless documented in a release.

Open Source

UnlockForge is developed as an open-source WordPress plugin.

If you find UnlockForge useful, you can support its development by sharing feedback, reporting issues, suggesting improvements, contributing code, and starring the project on GitHub.