Security
A paywall is only worth what it can’t be bypassed for.
Most content locks are theatre — a blur, a cookie, or a check that opens up the moment something goes wrong. x402 Paywall is built the other way around: access is enforced on the server, granted only after a payment actually settles, and denied by default when anything is uncertain. Here is exactly what that means, in plain terms.
The guarantees
Eight things the gate promises
Every one of these is enforced in code, not a marketing line. They are the reasons a paid page stays paid.
-
Access is granted only after settlement
A request sees paid content only after a facilitator confirms the USDC payment settled on-chain. Never from a cookie, a client flag, an unlock token, or the mere presence of a wallet. If it wasn't paid and settled, it stays locked.
-
No custody — ever
USDC settles peer-to-peer straight to the wallet address you configure. The plugin never holds, pools, or routes your funds, and there is no third-party gateway in the middle. You are paid directly; we are not your merchant of record.
-
Fail-closed, not fail-open
If the payment facilitator is unreachable or a check can't complete, the paywall stays locked. An outage never turns into free content. The safe default is always “deny,” so downtime can't be used as a bypass.
-
Every payment is re-bound server-side
Each payment is re-checked on the server against exactly what we published for that resource: the price, the asset, the network, and the payout address. A valid signature for the wrong amount, wrong recipient, or wrong chain is rejected.
-
Replay-proof
Consumed payments — EVM nonces and transaction hashes, Solana transaction signatures — are recorded and refused on reuse. One settled payment unlocks its resource once; it can't be replayed to unlock again.
-
Leak-proof by construction
Paid content is stripped on the server from every surface — the REST API, RSS and Atom feeds, search results, oEmbed, sitemaps, and bots — not hidden behind a CSS blur or a display:none overlay that anyone can peel back. There is nothing in the bytes to reveal.
-
Payout-wallet tamper protection
The receiving wallet can be pinned in wp-config and integrity-checked, so a compromised WordPress admin can't silently redirect your earnings to another address. Your payout destination is guarded, not just a setting in the database.
-
USDC-only; testnet and mainnet can't cross
The only accepted asset is USDC — no other tokens, no volatile coins. Networks are Base and Solana (each with its own testnet), and the design makes it impossible for a testnet payment to unlock mainnet content or vice-versa.
Auditable, not hand-wavy
How a single request is checked
The whole decision happens server-side, in three steps, before a single byte of paid content leaves your server.
-
Challenge
A request for paid content gets HTTP 402 with a machine-readable list of exactly what to pay: amount in USDC, network, asset, and your payout address.
-
Re-bind & verify
When a payment comes back, the server re-derives what it published for that resource and checks the payment matches it field-for-field, then asks the facilitator to verify and settle it on-chain.
-
Record & grant
Only after a confirmed settlement is the content released. The payment's nonce or signature is recorded so it can never be replayed, and the grant is idempotent.
The plugin is GPL and open — the enforcement is there to read, not to trust blindly. Read the open x402 spec →
Why the details matter
The failure modes are the whole game
A content lock can look identical to a real paywall right up until someone tests it. The common shortcuts — granting on a cookie or unlock token, serving content when the payment check is down, trusting a signature without re-checking the amount and recipient, or hiding the body with CSS instead of removing it — each turn into a trivial bypass under pressure.
x402 Paywall closes those paths on purpose: grant only after settlement, fail closed, re-bind every payment, block replays, and strip paid content from every surface. That is the difference between a paywall you can defend and one that only looks like one.
- Grant after settlement — never on a cookie or client flag
- Locked, not blurred — paid bytes are never sent
- Down means locked — outages don’t open the gate
- Right price, asset, chain and wallet — or rejected
- Each payment spends once — replays refused
- Funds go straight to your wallet — no custody, no middleman
FAQ
Security questions, answered
Can someone unlock paid content without paying?
No. Access is only ever granted after a facilitator confirms an on-chain USDC settlement, and the payment is re-checked server-side against the exact price, asset, network and payout address published for that resource. There is no client flag, cookie, or unlock token that grants access on its own, and the locked content is stripped from the response before it is sent — so there is nothing to reveal by viewing source, disabling CSS, or reading the REST API or RSS feed.
What happens if the payment facilitator goes down?
The paywall stays locked. The plugin fails closed: if a payment can't be verified and settled, the safe default is to deny access. An outage never causes paid content to be served for free.
Does the plugin ever hold my money?
No. USDC settles peer-to-peer directly to the wallet address you configure. The plugin never takes custody of funds and there is no third-party payment gateway in between. It is software, not a merchant of record or payment processor.
Can a settled payment be reused to unlock content again?
No. Consumed payments — EVM nonces and transaction hashes, and Solana transaction signatures — are recorded and rejected on reuse. A single settled payment unlocks its resource once and cannot be replayed.
If my WordPress site is compromised, can an attacker redirect my payouts?
The receiving wallet can be locked in wp-config and integrity-checked, so a compromised admin panel cannot silently change your payout address. Combined with peer-to-peer settlement and no custody, that keeps funds flowing to the wallet you control.
Lock your content with a paywall that holds
Install the free plugin, add your wallet, and gate your first post. Every guarantee on this page is in the free tier's server-side gate.