Description

GWiz IT Content Locker is a free, self-hosted lead-generation plugin for gating content, collecting email subscribers, connecting to popular email marketing platforms, and tracking conversions — without requiring a third-party SaaS service.

Key Features:

Restricted Areas — Create multiple gated areas, each with its own URLs, settings, form, and email templates.
Inline Shortcodes — Use [gwiz_it_content_locker area="AreaName"]...[/gwiz_it_content_locker] to gate content inline without replacing the entire page.
Hide by CSS Selector — Hide elements by class name (e.g., div.exampleclass) until the visitor signs up.
Custom Form Builder — Drag-and-drop form fields with 9 field types. The email field is always required.
Email Templates — Visual editors for confirmation and congratulations emails with placeholder support.
Popup Template — Customize the overlay popup with a visual editor and form placeholder.
Double Opt-In — Optionally require email confirmation before granting access.
HMAC-Signed Cookies — Visitor cookies are HMAC-signed with configurable expiration per area.
Signups Viewer — View, search, and export signups with customizable columns and CSV export (UTF-8 BOM for Excel).
Statistics — Track views, submissions, and confirmations with date-range filtering.
Clone & Export/Import — Duplicate restricted areas with a single click, or export/import area settings as ZIP backups (with optional contact migration). Includes forward-compatible version handling for safe backups.
Debug Mode — Per-area toggle that shows a cookie-status toolbar on the frontend so you can verify the gate is working.
Frontend Builder Support — Works with Elementor, Divi, and Beaver Builder.
Performance Optimized — Frontend JS/CSS only loads on pages that actually use the shortcode or have matching hide selectors.
Built-In Help Guide — A detailed, plain-English guide to every button and setting, accessible from the Help button on the Restricted Areas page.

Third-Party Integrations:

Sync confirmed signups automatically to your email marketing platform:

ActiveCampaign — Add contacts to a list with optional tags.
Brevo (formerly Sendinblue) — Add contacts to a list.
ConvertKit — Add subscribers to a sequence or tag.
Mailchimp — Add subscribers to an audience with optional tags.
phpList — Add subscribers to a mailing list via the phpList REST API.

Spam protection options:

Google reCAPTCHA v2 — Classic checkbox captcha.
Google reCAPTCHA v3 — Invisible score-based captcha.
ALTCHA (self-hosted) — Lightweight, privacy-friendly proof-of-work captcha with no external API calls.

External Services:

This plugin optionally connects to the following third-party services when configured by the site administrator. No data is sent to any external service until you explicitly enable and enter your API credentials for that service.

ActiveCampaign — Syncs confirmed subscriber email addresses to your ActiveCampaign account via their API. (ActiveCampaign Privacy Policy)
Brevo (formerly Sendinblue) — Syncs confirmed subscriber email addresses to your Brevo account via their API. (Brevo Privacy Policy)
ConvertKit — Syncs confirmed subscriber email addresses to your ConvertKit account via their API. (ConvertKit Privacy Policy)
Mailchimp — Syncs confirmed subscriber email addresses to your Mailchimp audience via their API. (Mailchimp Privacy Policy)
phpList — Syncs confirmed subscriber email addresses to your self-hosted phpList installation via its REST API.
Google reCAPTCHA — When enabled, loads the Google reCAPTCHA script to protect signup forms from spam. Sends the visitor IP address and browser information to Google for verification. (Google Privacy Policy)

All data transfer occurs over HTTPS. The ALTCHA captcha option is fully self-hosted and does not connect to any external service.

Shortcode Usage

Gate content inline using the shortcode:

[gwiz_it_content_locker area="AreaName"]This content is hidden until the visitor signs up.[/gwiz_it_content_locker]

The area attribute uses the area’s display name. If multiple areas share the same name, Windows-style deduplication applies: AreaName, AreaName2, AreaName3.

The exact shortcode for each area is shown in the area’s Settings modal.

Important — logged-in users never see the gate: if you are logged in (for example as an administrator), the plugin intentionally shows the unlocked content with no signup form, so you are never gated on your own site. If the wrapped text just appears with no form, you are almost certainly logged in. To see the gate as a visitor would, log out or open the page in a private/incognito browser window. To preview the gate while logged in, enable Debug Mode in the area’s Settings modal — that shows the form to logged-in administrators too. Developers can adjust this behavior with the gwiz_it_content_locker_bypass_logged_in filter.

Hooks

Filters

gwiz_it_content_locker_load_frontend — Control whether frontend assets load on the current page.

add_filter( ‘gwiz_it_content_locker_load_frontend’, function( $should_load, $post ) {
// Force-load on a specific page template.
if ( is_page_template( ‘template-custom.php’ ) ) {
return true;
}
// Prevent loading on the shop page.
if ( is_shop() ) {
return false;
}
return $should_load;
}, 10, 2 );
`

Parameters:
* $should_load (bool) — Whether assets should load. Default is auto-detected based on shortcode/selector presence.
* $post (WP_Post|null) — The current post object.

Screenshots

Administration page showing multiple restricted areas — Sample signup form

Installation

Upload the g-wiz-it-content-locker folder to the /wp-content/plugins/ directory.
Activate GWiz IT Content Locker through the Plugins screen in WordPress.
Click the GWiz IT Content Locker menu item in the admin sidebar to manage restricted areas.
Visit GWiz IT Content Locker Settings to configure default templates and security settings.

FAQ

Where can I find help for each button?

Click the Help button at the top of the Restricted Areas page. It opens a detailed guide that explains every button and setting with a sample of each button alongside the explanation.

How do I find the shortcode for my area?

Click the ⚙️ Settings button on any restricted area card. The shortcode is displayed at the top with a Copy button.

Why do I see my content with no signup form?

Because you are logged in. Logged-in users always receive the unlocked content without a form — this is by design so site editors and administrators are never gated on their own site. Test as a visitor: log out, or open the page in a private/incognito browser window. To preview the gate while logged in, enable Debug Mode in the area’s Settings modal.

What happens if two areas have the same name?

The plugin uses Windows-style deduplication. The first area keeps the base name, the second gets a 2 suffix, the third gets 3, etc. The exact shortcode is always shown in the area’s settings.

Can I use this with Elementor or Divi?

Yes. The plugin pre-scans Elementor (_elementor_data), Divi (_et_pb_post_content), and Beaver Builder (_fl_builder_data) content for shortcodes and hide selector class names.

How do I hide elements by class name?

In the area’s Settings modal, enter CSS selectors in the Hide by Selector textarea (one per line). For example: div.exampleclass or span.highlight. Elements matching these selectors will be hidden until the visitor signs up.

Can I show the form only on the first shortcode instance?

Each shortcode instance on the page renders independently. If you need the form on only one instance, place the shortcode once and use CSS selectors to lock other elements on the page.

Does the plugin load JS/CSS on every page?

No. The plugin pre-scans the current page’s content (including Elementor/Divi/Beaver Builder data) and only loads frontend assets when the shortcode is detected or when hide selector class names are found in the page content.

How do I clone a restricted area?

Click the 📋 Clone button on any restricted area card header. A popup will ask whether to include contacts (defaults to No). The clone is created immediately as a disabled copy with a unique name suffix (e.g. “My Area-1”) and a different color.

How do I export/import area settings?

Click the 📦 Export button on any area card to download a ZIP backup file. To import, click the 📥 Import Settings button on an existing area (to overwrite it) or the Import Area button at the top of the page (to create a new area from the backup). A popup will ask whether to include contacts. Backups are forward-compatible: if you import a backup from an older plugin version, missing settings will use their defaults.

Can I transfer contacts between areas?

Yes. When cloning or exporting, check the “Include contacts/users?” option. When importing, contacts from the backup file will be added to the target area. Note that this creates new signup records (contacts are not de-duplicated by email).

How do I force-load assets on a specific page?

Use the gwiz_it_content_locker_load_frontend filter (see Hooks section below).

Is the CSV export Excel-compatible?

Yes. The CSV includes a UTF-8 BOM (Byte Order Mark) at the start of the file, which tells Excel to use UTF-8 encoding. This ensures non-English characters (accented letters, CJK, etc.) display correctly.

What email placeholders are available?

Confirmation Email: {{confirm_link}}, {{site_name}}, {{email}}, {{area_name}}, {{source_url}}

Congratulations Email: {{site_name}}, {{email}}, {{area_name}}, {{source_url}}

Popup Template: {{form}}, {{already_signed_up_link}}, {{site_name}}, {{area_name}}, {{file_name}}

How does the “I have already signed up” link work?

The popup template includes an {{already_signed_up_link}} placeholder. When clicked, it shows an email-only verification form. If the email exists as a confirmed signup for that area, the visitor’s cookie is set and they gain access. If not found, a generic message is shown (to prevent email enumeration).

Reviews

There are no reviews for this plugin.

Contributors & Developers

“GWiz IT Content Locker” is open source software. The following people have contributed to this plugin.

Translate “GWiz IT Content Locker” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.7.3

Fixed: restricted area rename — pressing Enter or clicking outside the name field now saves the change, and Escape cancels it.
Fixed: the area color picker no longer crashes with a JavaScript error and opens correctly.
Fixed: form and email template editors no longer open blank for newly created areas — they are pre-filled with the default templates.
Improved: the logged-in bypass is now documented where users look for shortcode help (area settings modal, help page, and readme FAQ).

1.7.2

Fixed: scripts and styles are now registered and enqueued via the WordPress scripts and styles API.
Fixed: shortcode callback output is now escaped with wp_kses and an explicit allowlist.
Fixed: text domain renamed to g-wiz-it-content-locker to match the plugin slug.

1.7.0

Breaking: plugin renamed from “GWiz GWiz IT” to “GWiz IT Content Locker” to avoid trademark confusion with Gravity Wiz.
Breaking: shortcode changed from [gwiz_leadgate] to [gwiz_it_content_locker]. Update any existing pages/posts using the old shortcode.
Breaking: all internal prefixes renamed (text domain, function names, option names, database table names, CSS classes, JS variables).
Breaking: database tables renamed from wp_gwiz_gwiz_it_* to wp_gwiz_it_content_locker_*.
If upgrading from 1.6.x: export your areas first, uninstall the old version, install the new version, then import your areas from backup.
Improved: WordPress coding standards compliance — resolved all PHPCS errors and warnings.

1.6.2

Improved: WordPress coding standards compliance — resolved all PHPCS errors and warnings from the WordPress Plugin Checker.
Improved: added missing translators comments for all translatable strings with placeholders.
Improved: nonce verification annotations for all AJAX handlers (nonce checks were already present via verify_ajax()).
Improved: replaced deprecated functions — unlink() with wp_delete_file(), parse_url() with wp_parse_url().
Improved: input sanitization and validation for cookie values and server variables.
Improved: database query annotations for custom table operations (DirectDatabaseQuery, InterpolatedNotPrepared).
Improved: moved HTML tags outside translatable strings for proper i18n compliance.
Improved: added isset() checks for $_SERVER superglobal access.
No functional changes or database schema updates.

1.6.1

Fixed: the debug-mode “temporarily close” button now respects the “Keep inline signup forms visible after popup is dismissed” setting. Previously, closing the popup with debug mode enabled did not set the session flag, so inline forms remained visible on subsequent page loads even when the setting was unchecked.

1.6.0

Added Clone feature: duplicate any restricted area with one click. The clone is created disabled with a unique name suffix (-1, -2, -3, etc.) and a different color. Optionally include contacts in the clone.
Added Export feature: download a ZIP backup of any restricted area containing all settings, templates, URLs, and optionally contacts. The backup includes a manifest with plugin version metadata for forward-compatible restores.
Added Import feature: restore area settings from a ZIP backup. Import creates a new area (with automatic name deduplication) or overwrites an existing area’s settings with a confirmation warning. Version mismatch warnings are shown when importing backups from older plugin versions.
Added top-of-page “Import Area” button alongside “Add New Area” for creating new areas from backup files.
Added “Include contacts/users?” option to all clone, export, and import operations (defaults to No for clone/export, No for import).
Backup files use a ZIP format with separate JSON files (manifest.json, area.json, urls.json, signups.json) for maximum compatibility and readability.

1.5.1

Added background colors to the new Form Template, Form/Popup Styles, and Preview buttons.
Stacked the Inline Form and Full-Page Popup style sections vertically instead of side-by-side columns.
Added a title above the preview showing which form/popup state is currently displayed.

1.5.0

Renamed “Popup Template” to “Form Template” and moved the Confirm Notice template under it (removed the separate Confirm Notice button).
Added a “Form/Popup Styles” option with presets (Default, Modern, Dark, Rounded, Minimal) plus per-field controls for font, colors, size, radius, alignment, and position — separately for inline forms and full-page popups.
Added a “Preview” button that opens a modal previewing every form/popup state, with prev/next arrows to navigate and non-interactive forms.
Styles are applied via CSS variables to both the inline form card and the full-page popup overlay.

1.4.1

Debug mode banner is now always pinned to the bottom of the inline form and full-page popup, below any AJAX views.
Added a green/red cookie status line above the debug banner showing whether the area access cookie is currently valid.
Admin modals are now constrained to the browser window with an internal vertical scroll bar, so they stay on screen at high zoom levels.

1.4.0

Added a “Not Signed Up” template shown (via AJAX) when a visitor verifies an email on the “already signed up” form that has not signed up, with a link back to the signup form.
The “Already Signed Up” template now includes a close button by default (new {{close_label}} placeholder).
Moved the “Already Signed Up” template editor into the Popup Template modal (Popup / Already Signed Up / Not Signed Up) and removed the separate button on each restricted area.
The “already signed up” email check is now fully AJAX on inline forms — no page refresh; closing the already-signed-up view reveals the content immediately.
Added global defaults for the new templates on the Settings page.
Added the not_signedup_template database column (automatic migration).

1.3.2

Fixed: the “Already signed up” link in popup templates that use the older gwiz-it-already-signed-up class now opens the verification form instead of refreshing the page.
Fixed: the default popup templates no longer nest an anchor inside the {{already_signed_up_link}} placeholder (invalid HTML).
Fixed: no duplicate “already signed up” link is appended when the template already contains one.

1.3.1

Fixed: elements matched by the CSS Selector setting were not hidden because the generated hide class never matched the stylesheet rule (attribute selector now matches classes anywhere in the class list, plus a data-attribute fallback).
Fixed: selector-matched elements are now hidden with an inline style as well, so the gate still blocks content when the stylesheet is served from cache.
Fixed: selector gates are injected immediately at script parse time (no flash of unprotected content) and can no longer be injected twice.
Added: with Debug Mode enabled on an area, logged-in administrators now see the gate so they can preview it on the frontend.
Added: gwiz_it_content_locker_bypass_logged_in filter for controlling the logged-in bypass.

1.3.0

Added [gwiz_it_content_locker] shortcode for inline content gating with Windows-style area name deduplication.
Added hide-by-CSS-selector feature with first/all display modes.
Added lead-capture form builder with drag-and-drop fields (9 field types).
Added email templates (confirmation + congratulations) with TinyMCE visual editors.
Added popup template editor with form and already-signed-up placeholders.
Added signups viewer with expandable detail rows, customizable columns, and form snapshot storage.
Added CSV export with UTF-8 BOM for Excel compatibility and field selection.
Added statistics modal with date-range filtering (views, submissions, confirmations, conversion rate).
Added per-area settings: debug mode, cookie expiration, double opt-in.
Added HMAC-signed per-area visitor cookies with configurable expiration.
Added confirmation link handler for double opt-in flow.
Added “I have already signed up” verification flow.
Added frontend builder support (Elementor, Divi, Beaver Builder shortcode detection).
Added performance optimization: frontend assets only load when shortcode or hide selectors are detected on the page.
Added gwiz_it_content_locker_load_frontend filter for developer control over asset loading.
Added new database tables for signups and analytics.
Security: all visitor-facing AJAX endpoints use nonce verification, input sanitization, and SameSite cookies.

1.2.0

Removed global enable toggle — each restricted area now has its own on/off toggle.
Added per-area settings: rename, color picker with preset colors, save button.
New areas spawn with a random color and inactive by default.
Areas store settings as JSON in the database (extensible for future features).
Frontend gating now only enforces active areas (is_active = 1).
Database migration runs automatically on version upgrade.
Area cards show active/inactive state with visual opacity and toggle switch.

1.1.0

Added custom database tables for restricted areas, URLs, and gated files.
Added Restricted Areas admin page with expandable area cards, URL management, and autocomplete.
Added Settings page with “Enable Lead Gating” toggle.
Added frontend gate overlay for restricted page/post URLs.
Added gated file download system with tokenized URLs and private file storage.
Added confirmation modals for destructive actions.

1.0.0

Initial plugin foundation.
Added the GWiz IT Content Locker administration dashboard.
Added translation-ready and GPL-licensed plugin structure.

Description

Shortcode Usage

Hooks

Filters

Screenshots

Installation

FAQ

Where can I find help for each button?

How do I find the shortcode for my area?

Why do I see my content with no signup form?

What happens if two areas have the same name?

Can I use this with Elementor or Divi?

How do I hide elements by class name?

Can I show the form only on the first shortcode instance?

Does the plugin load JS/CSS on every page?

How do I clone a restricted area?

How do I export/import area settings?

Can I transfer contacts between areas?

How do I force-load assets on a specific page?

Is the CSV export Excel-compatible?

What email placeholders are available?

How does the “I have already signed up” link work?