Question 1

How does the gated content checker work?

Accepted Answer

It fetches your pages the way a logged-out visitor would, with no account, no cookies, and crucially no JavaScript. Memberstack hides content in the browser, so anything that arrives in that raw response is content a visitor could read without logging in. The checker reports what came back and how it was gated, reading up to 25 pages found via your sitemap or homepage links, plus a handful of conventional members-area addresses that nothing links to.

Question 2

Does the checker respect robots.txt?

Accepted Answer

Yes, for pages it finds on its own. Nothing verifies that the person running a check owns the site, so ignoring robots.txt would make this a crawler anyone could aim at anyone. The one exception is paths you type in yourself: a members area is exactly what a sensible robots.txt disallows, so honouring it there would make the tool useless for its main job. Any path your robots.txt covers is offered back as a suggestion you can confirm in a click.

Question 3

Does the checker copy or store my gated content?

Accepted Answer

No. It measures what it finds, counting the words, links, images and media inside a gated element, and reports those counts. It never returns the content itself and nothing is stored after the scan finishes. A tool that echoed the text back would be a working paywall bypass for any URL someone pasted in, which would be the opposite of the point.

Question 4

Can it tell which pages I've gated in the dashboard?

Accepted Answer

Not on its own. Page and folder gating is a redirect that happens in the browser, so from outside the server looks identical whether a page is gated or not. That is why the checker lets you paste the paths you have gated: it fetches those logged out and tells you what a visitor gets if the redirect never runs.

Question 5

Why is my members-only content visible in the page source?

Accepted Answer

Because data-ms-content hides elements after Memberstack's script runs, which means the content was in the HTML before it ran. Memberstack documents this directly: front-end gating "isn't a fully secure solution. If Memberstack fails to load and a visitor knows the exact URL of your content, they will be able to access it." View-source, a disabled-JavaScript browser, or a plain HTTP request all bypass it.

Question 6

Is Memberstack's content gating secure?

Accepted Answer

It depends which mechanism you use. Page gating and data-ms-content are front-end authorization: excellent for shaping what members see, but the content still reaches the browser. Hosted Content is different. The HTML or link is stored inside Memberstack and delivered only after access has been checked, so it never appears in your page source at all. For anything you genuinely cannot afford to leak, that is the one to use.

Question 7

What does the checklist score mean?

Accepted Answer

It measures how much of Memberstack's own gating checklist your site follows: default-hidden elements, no public links to gated URLs, gated pages kept out of the sitemap, and a noscript fallback. It is deliberately not called a security score, because a site can follow every item and still have content in its HTML by design. If the checker found no gating at all there is no score, since there would be nothing to measure.

Question 8

The checker found nothing. Does that mean my gating is fine?

Accepted Answer

No. It means there was nothing to judge, which is a different thing. A members area is usually absent from the sitemap and unlinked from any public page, so a crawl can easily miss it entirely. If the result says no gating was found, add the paths you have gated and run it again so the checker looks in the right place.

Question 9

Why does it say my site answers 200 for pages that don't exist?

Accepted Answer

Some sites, single-page apps and certain site builders among them, return a rendered page for any URL at all rather than a 404. The checker tests this by asking for an address nobody could have created. When that comes back as a page, a successful response stops meaning anything, so the checker relies only on what is actually in each response and skips guessing at members-area addresses. It is not a problem to fix; it just limits what a status code can tell you.

Question 10

Everything I gate shows as readable. Is that normal?

Accepted Answer

Yes, and it is worth knowing rather than panicking about. Most Memberstack sites gate previews, upsells and member-only sections of otherwise public pages, where a determined reader getting in costs nothing. The result matters when what is behind the gate is the product: a course, a report, a download. That is the content to move into Hosted Content.

Question 11

How do I hide gated content properly in Webflow?

Accepted Answer

Set the element to display:none in your styles, then add data-ms-bind:style="display:block" alongside data-ms-content. Memberstack sets it back to visible once it has confirmed access, so the content is never briefly on screen for a visitor who should not see it. It does remain in the page source. That step closes the flash, not the source.

Question 12

What should I do about gated pages in my sitemap?

Accepted Answer

Remove them. A sitemap is a public, machine-readable list of your URLs, so gated pages in it both invite indexing and hand anyone curious a map of what sits behind the gate. In Webflow this is the per-page SEO setting; on a custom sitemap, exclude the gated paths when you generate it.

Question 13

What happens to visitors with JavaScript disabled?

Accepted Answer

Nothing is gated at all. Memberstack's script never runs, so no elements are hidden and no redirect fires. Memberstack's checklist recommends a noscript meta-refresh in your site header, which sends those visitors somewhere harmless before they can read anything.