UnlockForge

UnlockForge helps WordPress site owners protect posts and pages and control how visitors access protected content.

Version 0.1.0 provides social-login-based content unlocking, configurable protection modes, preview controls, Unlock Messages, bulk protection, and analytics.

The plugin separates authentication from content access, providing a foundation for additional access methods in future versions.

Features

Content Protection

Protect WordPress posts and pages using three protection modes:

• Disabled – Content is displayed normally.
• Preview – Show a configurable preview before requiring authentication.
• Full Lock – Hide protected content until the visitor completes the configured unlock flow.

Preview content can be configured by:

• Paragraphs
• Words
• Excerpt

Preview settings can be configured globally, with per-content overrides where supported.

Social Login

Visitors can unlock protected content using supported social-login providers.

Supported providers:

• Google
• Facebook
• X
• LinkedIn
• GitHub

OAuth credentials are configured from the WordPress admin settings.

UnlockForge establishes the visitor’s external identity and associates it with a WordPress user account.

Multiple external identities can be associated with the same WordPress user.

Unlock Messages

Create customized messages shown when visitors encounter protected content.

Unlock Messages support:

• Custom title
• Custom message
• Emoji
• Image
• WordPress category targeting
• Start and end scheduling
• Multiple categories

The plugin automatically selects the applicable Unlock Message for protected content based on its configured categories and schedule.

If no matching Unlock Message exists, the normal content protection flow is used.

Analytics

The Analytics dashboard provides visibility into content unlocking and social-login activity.

Available analytics include:

• Unlocks
• Unique Users
• Successful Logins
• Login to Unlock conversion
• Unlock Activity
• Login Providers
• Login Failures
• Top Protected Content
• Unlock Message Performance

Analytics can be viewed using:

• Today
• Last 7 Days
• Last 30 Days
• Last 90 Days
• Custom Date Range

Analytics timestamps are handled using the WordPress site timezone for date-range selection.

Bulk Protection

Apply protection settings to multiple existing posts or pages.

Bulk protection supports:

• Posts
• Pages
• All content
• Category-based filtering
• Protection mode selection
• Batch processing
• Operation progress tracking

Bulk operations process content in batches to avoid unnecessarily large requests.

External Identity Management

UnlockForge maintains external identity information separately from WordPress user accounts.

This allows a WordPress user to have multiple supported social-login identities while keeping authentication identity data separate from content access decisions.

How It Works

A simplified protected-content flow:

1. A visitor opens protected content.
2. UnlockForge checks the configured protection mode.
3. If authentication is required, the visitor is presented with the configured unlock experience.
4. The visitor authenticates using a supported social-login provider.
5. The external identity is established and associated with a WordPress user.
6. The visitor can access the protected content.

Authentication and content access are separate concepts in the plugin architecture, allowing future access methods to be added without coupling them directly to authentication.

Configuration

After activation, open:

**Settings → UnlockForge **

The plugin provides settings for:

• Preview
• Social Login
• Unlock Messages
• Bulk Protection
• Analytics
• About & Help

Social Login Setup

To use social login:

1. Open Settings → UnlockForge → Social Login.
2. Enable the required provider.
3. Create an OAuth application with the selected provider.
4. Enter the required client credentials.
5. Configure the provider’s OAuth callback URL using the URL displayed by UnlockForge .
6. Save the settings.
7. Test the login flow using a protected post or page.

Keep OAuth client secrets private and do not expose them in client-side code.

Unlock Messages

Unlock Messages can be targeted to WordPress categories and scheduled for specific periods.

A message can include:

• Title
• Message
• Emoji
• Image
• Categories
• Start date and time
• End date and time

When multiple messages match the same content, UnlockForge uses the applicable message based on its scheduling and matching rules.

Bulk Protection

Bulk Protection allows administrators to apply protection settings to existing content.

You can select:

• Posts or Pages
• All content or selected categories
• Disabled, Preview, or Full Lock

Bulk operations are processed in batches and display their progress while running.

Existing protection settings may be overwritten when applying a bulk operation.

Analytics

Analytics provides aggregated information about authentication and content-unlock activity.

Analytics events include:

• Login Started
• Login Successful
• Login Failed
• Content Unlock

Login failures are grouped by failure reason to help administrators identify problems with the authentication flow.

Testing & Troubleshooting

If an OAuth callback does not work after configuring a provider, visit:

Settings → Permalinks

and click Save Changes to refresh WordPress rewrite rules.

When testing social login:

• Confirm the provider is enabled.
• Confirm the OAuth client ID and secret are correct.
• Confirm the configured callback URL matches the provider configuration.
• Confirm the WordPress site URL is correct.
• Test using a protected post or page.

Privacy

UnlockForge may store information required to establish and associate external social-login identities with WordPress user accounts.

The information stored depends on the social-login provider and the configuration of the site.

Site administrators are responsible for configuring their site and privacy policies appropriately for the data collected through enabled authentication providers.

External services

UnlockForge uses third-party OAuth services when a site administrator enables the corresponding social-login provider. These services are used to authenticate visitors and retrieve the identity information required to create or associate an external identity with a WordPress user.

No external service is contacted for social login when its provider is disabled.

Google

UnlockForge uses Google OAuth to authenticate users and retrieve basic account information required for authentication and identity association.

Data sent to Google:
* OAuth authorization requests.
* OAuth authorization code during the authentication flow.

Data received from Google may include:
* Google account identifier.
* Name.
* Email address.
* Profile information made available through the configured Google OAuth scopes.

Google is contacted when a visitor chooses Google as their login provider.

Terms of Service: https://policies.google.com/terms
Privacy Policy: https://policies.google.com/privacy

Facebook

UnlockForge uses Facebook Login to authenticate users and retrieve account information required for authentication and identity association.

Data sent to Facebook:
* OAuth authorization requests.
* OAuth authorization code during the authentication flow.

Data received from Facebook may include:
* Facebook user identifier.
* Name.
* Email address.
* Profile information made available through the configured permissions.

Facebook is contacted when a visitor chooses Facebook as their login provider.

Terms of Service: https://www.facebook.com/legal/terms
Privacy Policy: https://www.facebook.com/privacy/policy

LinkedIn

UnlockForge uses LinkedIn OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to LinkedIn:
* OAuth authorization requests.
* OAuth authorization code during the authentication flow.

Data received from LinkedIn may include:
* LinkedIn member identifier.
* Name.
* Email address.
* Profile information made available through the configured scopes.

LinkedIn is contacted when a visitor chooses LinkedIn as their login provider.

Terms of Service: https://www.linkedin.com/legal/user-agreement
Privacy Policy: https://www.linkedin.com/legal/privacy-policy

X

UnlockForge uses X OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to X:
* OAuth authorization requests.
* OAuth authorization code during the authentication flow.

Data received from X may include:
* X user identifier.
* Name.
* Username.
* Email address when available through the configured access permissions.

X is contacted when a visitor chooses X as their login provider.

Terms of Service: https://x.com/en/tos
Privacy Policy: https://x.com/en/privacy

GitHub

UnlockForge uses GitHub OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to GitHub:
* OAuth authorization requests.
* OAuth authorization code during the authentication flow.

Data received from GitHub may include:
* GitHub user identifier.
* Name.
* Username.
* Email address.

GitHub is contacted when a visitor chooses GitHub as their login provider.

Terms of Service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service
Privacy Statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

Security

UnlockForge uses WordPress security mechanisms including:

• WordPress nonces for protected administrative actions.
• WordPress capability checks for administrative operations.
• Sanitization of submitted values.
• Escaping of output.
• OAuth state validation.
• Protected storage of provider credentials.

OAuth client secrets should never be exposed publicly.

Planned / Future

Payment-based content unlocking is planned for a future version.

Future development may include:

• Payment-based content access
• Per-content payment entitlement
• Additional payment providers
• “Pay once, see all” access
• Additional access methods
• Expanded analytics and event tracking

Payment functionality is intentionally not included in V1.

Open Source

UnlockForge is being developed as an open-source WordPress plugin.

If you find the project useful, consider supporting its development by contributing feedback, reporting issues, or starring the project on GitHub.