HomeWalkthroughsPaywall gates
Where a web paywall lives: client state, payload, or server
A blurred article is not always a locked article. The useful question is which side actually withholds the work. Three gates feel identical on screen and leave different evidence.
Independent guide. Telling them apart is product literacy. It is not permission to take the content. We publish no circumvention steps, no request rewrites, and no instructions for defeating a paywall or a licence check.
Three places a gate can live
Web products hide unpaid work in the page, in the response, or on the server. Use the split when you are designing your own access model, or when you are studying why a gate feels fragile. Do not remove a publisher's check, rewrite a request to impersonate a subscriber, or extract paid content you are not entitled to. Those are not rebuilds. A rebuild is your own entitlement check, on your own content, with the withholding done on the server if the work is actually meant to be paid.
Three stops, one fixture paragraph we wrote. Dragging changes what a reader can observe. It does not fetch, rewrite, or unlock anything.
A field guide can describe a gate without opening it. This sentence is fixture copy written for the demo, not someone else's article.
A field guide can describe a gate without opening it. This sentence is fixture copy written for the demo, not someone else's article.
Client state
Look at The article node, and the class on it. You see: The unpaid sentences are already text in the page. A style only covers them. You cannot measure: Whether the server would also refuse this reader.
Client state
The publisher sent the work and asked the browser to cover it. The gate is presentation.
| Where to look | What you see if this is the gate | What you cannot measure |
|---|---|---|
| The article node in the DOM | The unpaid sentences are already text nodes. A class, a max-height, or an overlay is what hides them. | Whether a later request would also be refused. The text being present does not mean the server is open. |
| The stylesheet for that node | A blur, a clip, or overflow on the article, with no second request for the rest of the piece. | The entitlement decision. CSS does not record why the class was applied. |
| A flag in the page script | A boolean only toggles the class. The paragraphs were in the HTML before the flag ran. | Anyone else's subscription. A flag in your browser is your session's presentation, not their account. |
Response payload
The document arrives already shortened. The interesting design is what an anonymous response contains, compared with a response for a session that is actually entitled.
| Where to look | What you see if this is the gate | What you cannot measure |
|---|---|---|
| The body of the article response | A title, a stub, and a subscribe line. The remaining paragraphs are absent, not merely hidden. | The member body. It was not in this response. |
| Your own two sessions, if you have both | The entitled session's body is longer. The anonymous body stops at the stub. | How the server chose. You can see the two payloads. You cannot see the check. |
| The page bundle | No second copy of the missing paragraphs in a script or a JSON blob. | A payload that would be returned to a different account. Looking at your response does not reveal theirs. |
Server
The resource is not in the response until the server has checked an entitlement. Nothing in the page bundle can reveal it, because it was never sent. This is the same limit as the last step of the 6-step loop: when the rule stays on the server, you can name the boundary and you cannot read the decision.
| Where to look | What you see if this is the gate | What you cannot measure |
|---|---|---|
| Status and JSON keys | 401 or 403, or a 200 whose body has no article field. The copy is not a key you failed to notice. | The rule that returned that status. The response is the outcome, not the check. |
| The page bundle and the DOM | No hidden node, no stub of the paid section, no constant that contains the missing text. | The work itself. If it was not sent, the browser does not have it to show you. |
| Timing of the refusal | The refusal arrives before any article bytes. There is no partial body to scroll. | Which input the server weighed: cookie, account, region, or something you cannot see. |
Read it, don't break it. Do not remove a publisher's check, rewrite a request to impersonate a subscriber, or extract paid content you are not entitled to. We publish no circumvention steps, no request rewrites, and no instructions for defeating a paywall or a licence check.