How it works

A lock is a flag stored in post meta, beside the post status rather than instead of it. A locked post can be published, private, draft or any custom status, and front-end queries, sitemaps and feeds treat it exactly as they would an unlocked post.

Storage

The flag is registered for the REST API so the block editor can read and save it. Only users with the lock capability can write it.

Enforcement

A map_meta_cap filter adds do_not_allow to edit_post, edit_page, delete_post, delete_page and publish_post on a locked post for anyone without the lock capability (manage_options by default). Edit and Trash links disappear for them, and the editor and REST API refuse changes.

Comment moderation is deliberately left alone: core checks edit_comment through edit_post, so the plugin recomputes it without the lock and editors can still approve, edit or remove comments on a locked post.

Interface

Users without the lock capability see none of these controls.

Lockable post types

Every post type with an admin screen and custom-fields support, except attachments. Custom-fields support is needed for the meta to reach the block editor.

Copies

A post copied with LH Copy to Draft starts unlocked, with no lock history, and no unlock event fires for it.