Six Ways to Lock Down a Link (And When to Use Each One)

A Link Isn't Just "Protected" or "Not Protected"

Most link tools give you one lever: on or off. ShieldmyLinks gives you six, and they answer six different questions about who should be allowed through.

The mistake we see most often isn't picking the wrong gate — it's assuming captcha is the only gate, and reaching for it to solve a problem it was never built for. A captcha proves the visitor is human. It says nothing about which country they're in, whether the link is supposed to be open yet, whether it already hit capacity, or whether they actually know the password. That's what the other five gates are for.

Every gate below runs on the same server-side check before a link's destination is ever revealed — so they combine freely. A link can be geo-restricted and password-protected and time-limited at the same time, with no extra work.

---

1. Captcha — proves the visitor is human

The baseline gate. Choose reCAPTCHA v2 (a checkbox, strongest) or reCAPTCHA v3 (invisible, lower friction) per link when you create it.

Stops: scrapers, link-harvesting bots, automated group-join scripts. Doesn't stop: a human who simply isn't supposed to have the link.

---

2. Geo-Fencing — restricts by country

An allow-list ("only these countries") or a block-list ("everyone except these countries"), enforced the moment someone clicks — before the captcha even loads.

Stops: access from regions your offer isn't licensed or available in, or regions responsible for repeated abuse. Doesn't stop: a visitor on a VPN presenting as a different country — geo-fencing fails open on a lookup error, by design, so a third-party API hiccup never locks out a real visitor.

---

3. Password — restricts by what they know

Set a password on any link. Visitors enter it alongside the captcha before the destination unlocks. We store it hashed — nobody at ShieldmyLinks can read it back, including you, so keep your own copy.

Stops: anyone who wasn't given the password directly, even if they have the URL. Use it for: client deliverables, private event details, anything shared with a specific group rather than the public internet.

---

4. Availability Window — restricts by time

Set an "opens at" and/or "closes at" time. Before the window opens, visitors see a live countdown instead of the destination — nothing about the destination is exposed early. After it closes, the link simply stops working.

Stops: early access, late arrivals, or a link that's still "live" long after the offer it pointed to expired. Use it for: timed announcements, application deadlines, embargoed content, or a link you want to publish today but not activate until launch.

---

5. Visit Limit — restricts by capacity

Set a maximum number of successful visits. Once that many people have gotten through, the link closes itself — no manual monitoring, no race condition where two people squeeze through the same last spot.

Stops: overselling a fixed number of seats, spots, or downloads. Use it for: limited registrations, "first 100" offers, anything with a hard capacity.

---

6. Allowed Referrers — restricts by where the click came from

List the domains a click is allowed to arrive from (e.g. your own site, your newsletter platform). Subdomains are covered automatically.

Stops: casual link-lifting — someone copying your link out of its intended context and reposting it elsewhere. Doesn't stop: a determined visitor. Referrer information is sent by the browser and can be omitted or faked, so treat this as a deterrent, not a lock. We say so directly in the dashboard rather than oversell it.

---

Plus: Pause

Not a gate a visitor encounters differently — a kill switch for you. Pause any link instantly from the dashboard without deleting it. Its analytics history stays intact, and resuming brings it right back. Use it the moment a link leaks somewhere it shouldn't have, or between events that reuse the same link.

---

Layering Gates: A Worked Example

Say you're running a members-only workshop with 40 seats, open only to a specific country, that shouldn't be shareable outside your newsletter:

1. Geo-fencing — allow-list your country
2. Password — the one you send in the newsletter itself
3. Availability window — opens the morning registration starts, closes when the event does
4. Visit limit — 40
5. Captcha — on by default, keeps scraper bots out of the count entirely

Every visitor who gets through has passed all five checks, in that order, on our servers — never in the browser, so none of it can be bypassed by skipping past the visible page.

---

Choosing the Right Gate

If the problem is...	Use...
Bots and scrapers	Captcha
The wrong country	Geo-fencing
Someone who wasn't given access	Password
It's too early or too late	Availability window
You're out of capacity	Visit limit
The link escaped its intended channel	Allowed referrers (deterrent)
You need to shut it off right now	Pause

None of these require re-issuing the link. Every gate is something you turn on, adjust, or turn off from the Edit modal on a link you've already shared — the URL never has to change.