=== UnlockForge ===
Contributors: shivaacharjee
Tags: content protection, social login, membership, paywall, content locker
Tested up to: 7.1
Stable tag: 0.4.0
Requires at least: 6.8
Requires PHP: 7.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Protect WordPress content with previews, Social Login, Email Unlock, and paid access through Razorpay.

== Description ==

Protect WordPress content with previews, Social Login, Email Unlock, and paid access through Razorpay.

Version 0.4.0 includes Social Login, Email Unlock, configurable protection modes, custom Unlock Messages, bulk protection, analytics, external identity management, and Razorpay payment integration for sites that want to charge for protected content.

Visitors can authenticate using Google, Facebook, X, LinkedIn, or GitHub, or verify their email address using a one-time code. Site owners can customize the unlock experience, apply protection to multiple items, and review activity through the Analytics dashboard.

UnlockForge is suitable for publishers, membership sites, blogs, educational websites, documentation sites, resource libraries, and other WordPress sites that need controlled access to content.

### What can you do with UnlockForge?

* Protect WordPress posts and pages.
* Show a configurable preview before the unlock gate.
* Lock content until the configured unlock requirements are met.
* Offer Social Login through supported OAuth providers.
* Let visitors verify their email using a one-time code.
* Configure paid content using Razorpay.
* Customize unlock gates with titles, messages, images, and emoji.
* Target Unlock Messages by WordPress category and schedule.
* Apply protection settings to multiple posts and pages in bulk.
* Review authentication and content-unlock analytics.
* Manage external authentication identities separately from content-access decisions.

Authentication and entitlement are separate concepts. Logging in alone does not grant access to content that requires a successful payment or another configured entitlement.

== Features ==

= Content Protection =

Choose one of three protection modes for posts and pages:

* **Disabled**: Display content normally.
* **Preview**: Display a configurable portion of the content before the unlock experience.
* **Full Lock**: Hide protected content until the configured unlock requirements are satisfied.

Preview methods include paragraphs, words, and excerpts. Global preview settings are available, with per-content overrides where supported.

= Social Login =

Allow visitors to unlock protected content using supported social-login providers:

* Google
* Facebook
* X
* LinkedIn
* GitHub

Configure OAuth credentials from the WordPress admin settings. UnlockForge associates the external identity with a WordPress user account. Multiple external identities can be associated with the same WordPress user, while content-access decisions remain separate from authentication.

= Email Unlock =

Email Unlock lets visitors verify an email address without using a social-login provider.

The visitor flow is:

1. Enter an email address.
2. Request a verification code.
3. Receive the code by email.
4. Enter the code.
5. Unlock the protected content after successful verification.

Configurable email settings include the OTP email subject, message, expiration, and supported placeholders:

* `{{otp}}`: The verification code.
* `{{expires_in}}`: The number of minutes before the code expires.
* `{{site_name}}`: The WordPress site name.

Email delivery uses the WordPress mail system. Administrators can configure their preferred SMTP plugin or transactional email service.

= Paid Content with Razorpay =

Version 0.4.0 introduces Razorpay payment integration for sites that want to charge visitors for protected content.

Depending on the site's configuration and the enabled payment flow, administrators can configure payment credentials, currency, test or live mode, and webhook verification. Payment notifications can use configurable email templates for supported payment outcomes.

A payment must be verified before paid access is granted. Authentication and payment entitlement remain separate: a visitor being logged in does not, by itself, unlock paid content.

Razorpay requires the site owner to have their own Razorpay account and credentials. The site owner is responsible for completing any account verification and onboarding required by Razorpay.

= Custom Unlock Messages =

Customize the message visitors see when they encounter protected content. Unlock Messages support:

* Custom title and message.
* Emoji and image.
* WordPress category targeting, including multiple categories.
* Start and end dates and times.

Messages can be scheduled and targeted to categories. If no matching message applies, UnlockForge uses the normal content-protection flow.

= Bulk Protection =

Apply protection settings to multiple existing posts or pages without editing each item individually.

Bulk Protection supports:

* Posts and pages.
* All content or category-based filtering.
* Disabled, Preview, and Full Lock modes.
* Batch processing and progress tracking.

Review the selected content scope and protection mode before starting an operation. Applying a bulk operation may overwrite existing protection settings for the selected items.

= Analytics =

Review authentication and content-unlock activity from the Analytics dashboard. Available metrics and reports include:

* Unlocks and unique users.
* Successful logins and login failures.
* Login-to-unlock conversion.
* Unlock activity and login providers.
* Top protected content.
* Unlock Message performance.

Available date filters include Today, Last 7 Days, Last 30 Days, Last 90 Days, and a custom date range. Date-range selection uses the WordPress site timezone.

= External Identity Management =

UnlockForge stores external authentication identity information separately from WordPress user accounts and content-access decisions. This allows a user to associate multiple supported external identities with one WordPress account and supports the plugin's separate authentication and access-control model.

== How It Works ==

A simplified content-unlock flow:

1. A visitor opens protected content.
2. UnlockForge checks the configured protection mode.
3. If the content is protected, the visitor sees the configured preview or unlock gate.
4. The visitor selects an available unlock method.
5. The visitor authenticates through Social Login, verifies an email address, or completes the configured payment flow where enabled.
6. UnlockForge validates the relevant authentication or payment result.
7. Access is granted according to the configured protection and entitlement rules.

Authentication is not the same as payment entitlement. Paid access must be established independently of whether a visitor has logged in.

== Installation ==

1. Upload the `unlockforge` folder to the `/wp-content/plugins/` directory.
2. Activate UnlockForge from the WordPress Plugins screen.
3. Open **Settings → UnlockForge**.
4. Configure the features you want to use.
5. Apply protection to a post or page and test the visitor-facing experience.

For detailed setup instructions, refer to the UnlockForge documentation.

== Configuration ==

Open **Settings → UnlockForge** after activating the plugin.

The settings areas include:

* Preview.
* Social Login.
* Email Unlock.
* Payment.
* Unlock Messages.
* Bulk Protection.
* Analytics.
* About & Help.

The options available depend on the installed plugin version.

== Setup Guides ==

For instructions on configuring Social Login providers, Email Unlock, WordPress email delivery, or Razorpay payments, refer to the relevant setup documentation.

For Razorpay payments, review the official resources below:

* Terms and Conditions: https://razorpay.com/terms/
* Privacy Policy: https://razorpay.com/privacy-policy/
* API key documentation: https://razorpay.com/docs/payments/dashboard/account-settings/api-keys/
* Webhook documentation: https://razorpay.com/docs/webhooks/

Keep OAuth client secrets, payment API secrets, and webhook secrets private.

== Security ==

UnlockForge uses WordPress security mechanisms and validation across its administrative, authentication, and content-unlock flows.

= WordPress Security =

Security measures include:

* WordPress nonces for protected administrative and AJAX actions.
* WordPress capability checks for administrative operations.
* Sanitization of submitted values.
* Escaping of output.
* Protected handling of provider credentials.

= OAuth Security =

Social Login uses OAuth state validation to protect the authentication callback flow. The implementation includes server-side state storage, browser-bound nonce validation, single-use state values, and cookie protections such as Secure when HTTPS is enabled, HttpOnly, and SameSite.

OAuth client secrets should never be exposed publicly or included in client-side JavaScript.

= Email OTP Security =

Email Unlock includes temporary OTP challenges, OTP expiration, hashed OTP storage, browser-bound verification challenges, email-based and IP-based rate limiting, WordPress nonce validation, server-side content-context resolution, and challenge consumption during verification.

OTP values are not stored as plaintext in the temporary verification challenge. Rate limiting helps reduce repeated requests and automated abuse.

= Payment Security =

For Razorpay payments, configure the correct API credentials and webhook secret for the selected mode. Keep secrets private and test payment flows before accepting live transactions. Do not treat a browser redirect or client-side message alone as proof of payment. Paid access should depend on verified payment state.

= Server-Side Content Context =

UnlockForge resolves the content context server-side before creating an Email Unlock challenge. This helps prevent a visitor from changing a client-side content identifier to associate a verification flow with unrelated protected content.

= Privacy and Data Handling =

UnlockForge may store information needed to associate authentication identities with WordPress users, record analytics, process payment status, and manage paid-content entitlement where those features are enabled. The exact data depends on the authentication method, payment configuration, and site setup.

UnlockForge provides privacy erasure handling for stored identity information and anonymizes associated analytics user references where applicable. Site administrators are responsible for configuring their privacy policy and disclosures for enabled authentication methods, analytics, payment processing, and third-party services.

== Screenshots ==

1. Preview Settings for configuring protected content previews.
2. Bulk Protection for applying protection to multiple posts or pages.
3. Category-based content protection management.
4. Social Login settings for configuring OAuth providers.
5. Unlock Messages for creating customized and scheduled unlock experiences.
6. Analytics dashboard showing authentication and content-unlock activity.
7. User-facing content lock gate with authentication options and a customized unlock message.
8. Email Unlock Settings with a configurable email template.
9. User-facing Email Unlock gate for protected content.
10. User-facing OTP verification for content unlock.
11. Shows the paid content gate with Razorpay payment integration.
12. Provides a glimpse of the payment settings page, where administrators can configure payment options.
13. Shows how content locking can be configured directly from an individual post or page, making it easy to control access without navigating to the plugin settings.

== Unlock Messages ==

Unlock Messages allow site administrators to customize the experience visitors see when they encounter protected content. A message can include a title, message, emoji, image, categories, start date, and end date. Messages can target specific WordPress categories and be scheduled for specific periods.

When multiple messages match the same content, UnlockForge uses the applicable message based on its matching and scheduling rules.

== Analytics ==

UnlockForge records authentication and content-unlock events to provide visibility into protected-content activity. Events include Login Started, Login Successful, Login Failed, and Content Unlock.

Login failures are grouped by failure reason to help administrators identify authentication issues. The Analytics dashboard provides activity information and aggregated metrics such as unique users and login-to-unlock conversion.

== Bulk Protection ==

Bulk Protection lets administrators apply settings to multiple existing posts and pages. Select posts or pages, all content or selected categories, and Disabled, Preview, or Full Lock. Operations are processed in batches and display progress while running.

Applying a bulk operation may overwrite protection settings for the selected items. Review the scope and mode before starting.

== Testing and Troubleshooting ==

If an authentication or payment flow does not work as expected, verify the relevant settings and credentials, check the provider's configuration, and review your WordPress and server logs.

For provider-specific troubleshooting steps, refer to the UnlockForge documentation and the relevant provider's official documentation.

== Privacy ==

UnlockForge may store information required to associate external social-login identities and email-based authentication with WordPress users. Where payment features are enabled, payment-related identifiers, amounts, currency, statuses, and entitlement information may also be processed or stored as needed to manage transactions and paid access.

Analytics may store authentication and content-unlock activity for reporting. UnlockForge provides privacy erasure handling for stored identity information and anonymizes associated analytics user references where applicable.

Site administrators are responsible for updating their privacy policy and disclosures to describe the data collected through enabled authentication methods, analytics, Razorpay, and any configured email delivery providers.

== External Services ==

UnlockForge contacts third-party services when the corresponding feature is enabled and used. These services may process information needed to authenticate a visitor, deliver verification email, or create and verify payment transactions.

= Google =

UnlockForge uses Google OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to Google may include OAuth authorization requests and the authorization code used during the flow. Data received may include a Google account identifier, name, email address, and profile information permitted by the configured OAuth scopes. Google is contacted when a visitor chooses Google as their login provider.

Terms of Service: https://policies.google.com/terms
Privacy Policy: https://policies.google.com/privacy

= Facebook =

UnlockForge uses Facebook Login to authenticate users and retrieve account information required for authentication and identity association.

Data sent to Facebook may include OAuth authorization requests and the authorization code used during the flow. Data received may include a Facebook user identifier, name, email address, and profile information permitted by the configured permissions. Facebook is contacted when a visitor chooses Facebook as their login provider.

Terms of Service: https://www.facebook.com/legal/terms
Privacy Policy: https://www.facebook.com/privacy/policy

= LinkedIn =

UnlockForge uses LinkedIn OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to LinkedIn may include OAuth authorization requests and the authorization code used during the flow. Data received may include a LinkedIn member identifier, name, email address, and profile information permitted by the configured scopes. LinkedIn is contacted when a visitor chooses LinkedIn as their login provider.

Terms of Service: https://www.linkedin.com/legal/user-agreement
Privacy Policy: https://www.linkedin.com/legal/privacy-policy

= X =

UnlockForge uses X OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to X may include OAuth authorization requests and the authorization code used during the flow. Data received may include an X user identifier, name, username, and email address when available through the configured permissions. X is contacted when a visitor chooses X as their login provider.

Terms of Service: https://x.com/en/tos
Privacy Policy: https://x.com/en/privacy

= GitHub =

UnlockForge uses GitHub OAuth to authenticate users and retrieve account information required for authentication and identity association.

Data sent to GitHub may include OAuth authorization requests and the authorization code used during the flow. Data received may include a GitHub user identifier, name, username, and email address. GitHub is contacted when a visitor chooses GitHub as their login provider.

Terms of Service: https://docs.github.com/en/site-policy/github-terms/github-terms-of-service
Privacy Statement: https://docs.github.com/en/site-policy/privacy-policies/github-general-privacy-statement

= Email Delivery =

Email Unlock uses the WordPress mail delivery system to send verification emails. UnlockForge does not require a specific email provider. Site administrators can configure WordPress email delivery using an SMTP plugin or transactional email provider.

The configured email delivery provider may process the recipient email address, email subject, email message, and verification code contained in the email. Administrators should review the terms and privacy policy of their configured provider.

= Razorpay =

When Razorpay payments are enabled and used, UnlockForge communicates with Razorpay to create or verify payment transactions and receive payment webhook notifications.

Depending on the payment flow, information sent to or received from Razorpay may include order or payment identifiers, amount, currency, transaction status, and related payment metadata. Razorpay is contacted when a visitor initiates or completes a payment flow, or when Razorpay sends a configured webhook.

Terms and Conditions: https://razorpay.com/terms/
Privacy Policy: https://razorpay.com/privacy-policy/
API key documentation: https://razorpay.com/docs/payments/dashboard/account-settings/api-keys/
Webhook documentation: https://razorpay.com/docs/webhooks/

== Frequently Asked Questions ==

= Does UnlockForge support paid content? =

Yes. Version 0.4.0 introduces Razorpay integration for paid content. Payment availability depends on installing the version that includes the feature and configuring the site's Razorpay account and payment settings.

= Does logging in automatically provide access to paid content? =

No. Authentication and payment entitlement are separate. A logged-in user must still satisfy the access requirements configured for the protected content.

= Can visitors unlock content using email? =

Yes. Email Unlock allows visitors to verify an email address using a temporary one-time verification code.

= Can I use Social Login and Email Unlock together? =

Yes. Site administrators can enable and configure the supported authentication methods for their site.

= Can a WordPress user have multiple social-login providers? =

Yes. UnlockForge is designed to allow multiple external identities to be associated with the same WordPress user.

= Can I protect both posts and pages? =

Yes. UnlockForge supports protection for WordPress posts and pages.

= Can I show a preview instead of completely locking content? =

Yes. Preview mode can display a configurable portion of the content before the visitor is required to unlock it.

= Can I customize the unlock message? =

Yes. Unlock Messages support custom titles, messages, emoji, images, categories, and scheduling.

= Can I protect content in bulk? =

Yes. Bulk Protection allows administrators to apply Disabled, Preview, or Full Lock protection to multiple posts and pages.

= Do I need a Razorpay account? =

Yes. The site owner must have a Razorpay account and configure the credentials and webhook settings required for the payment flow. Any Razorpay onboarding or verification requirements are handled by Razorpay.

= Does UnlockForge require a specific email provider? =

No. Email Unlock uses the WordPress mail system. Site administrators can configure their preferred SMTP or transactional email delivery solution.

== Planned / Future ==

Potential future improvements may include:

* Additional payment providers.
* Expanded membership and entitlement options.
* Additional access methods.
* Expanded analytics and event tracking.
* A configurable "Pay once, see all" access option.

These are potential future enhancements and should not be interpreted as features currently available unless documented in a release.

== Open Source ==

UnlockForge is developed as an open-source WordPress plugin.

If you find UnlockForge useful, you can support its development by sharing feedback, reporting issues, suggesting improvements, contributing code, and starring the project on GitHub.

== Changelog ==

= 0.4.0 =

* Added Razorpay payment integration for paid content.
* Added payment settings for gateway credentials, currency, and test or live mode.
* Added Razorpay webhook configuration and payment event handling.
* Added payment notification email templates for supported payment outcomes.
* Kept authentication separate from paid-content entitlement.
* Fixed payment validation and error-handling issues.
* Improved payment status handling to support reliable entitlement decisions.
* Improved webhook handling and payment verification.
* Updated setup, security, privacy, troubleshooting, and external-service documentation.
* Added Razorpay Terms and Conditions, Privacy Policy, API key, and webhook documentation links.

= 0.3.0 =

* Added Email Unlock with one-time email verification codes.
* Added configurable OTP email subject and message.
* Added configurable OTP email placeholders.
* Added OTP expiration and temporary verification challenges.
* Added hashed OTP storage.
* Added browser-bound OTP verification.
* Added email-based OTP rate limiting.
* Added IP-based OTP rate limiting.
* Added improved authentication request validation.
* Improved OAuth security with browser-bound state validation.
* Improved privacy handling for stored identity information and analytics data.
* Added Email Unlock configuration and documentation.
* Improved authentication and content-unlock flows.

= 0.2.0 =

* Improved Preview Settings with clearer preview method controls and visual representations.
* Improved Bulk Protection with clearer content scope selection, protection mode guidance, and action summaries.
* Improved Social Login settings with a cleaner provider configuration interface and OAuth integration guidance.
* Improved Unlock Messages with an improved management interface.
* Improved admin interface styling, usability, and responsive layouts.
* Added basic guidance and visual improvements across plugin settings.

= 0.1.0 =

* Initial development release.
* Added content protection for posts and pages.
* Added Disabled, Preview, and Full Lock protection modes.
* Added social login support.
* Added Google, Facebook, X, LinkedIn, and GitHub OAuth providers.
* Added external identity management.
* Added Unlock Messages.
* Added Unlock Message scheduling and category targeting.
* Added configurable preview controls.
* Added bulk protection.
* Added analytics.
* Added About & Help documentation.
* Added RTL support.
* Added translation-ready strings.

== Upgrade Notice ==

= 0.4.0 =

Adds Razorpay payments for protected content, webhook verification, and payment email notifications. Fixes a settings issue that could prevent existing users from saving settings.
= 0.3.0 =

Added Email Unlock with OTP verification, OTP rate limiting, browser-bound authentication protections, and OAuth and privacy security improvements.