OfferGuard vs Locksmith on Shopify: Checkout Blocking vs Page Locking

Two different locks for two different doors

Locksmith and OfferGuard both restrict access to products. But they restrict access at completely different points, and that distinction matters more than most merchants realize.

Locksmith controls the product page. It hides or locks pages behind conditions like customer tags, passwords, or secret links. If a customer does not meet the condition, they cannot see the product page.

OfferGuard controls the checkout. It lets anyone browse and add products to their cart, but blocks the purchase if the customer has bought the protected product before. The block runs server-side through Shopify's Checkout Extensions API.

For memberships, wholesale catalogs, and content gating, Locksmith is the right tool. For new-customer-only products, trial offers, and intro pricing, page locks are not enough.

What Locksmith does well

Locksmith is one of the most established apps in the Shopify ecosystem. It has been around for years, it is built by a respected developer, and it handles a wide range of access control scenarios.

You can lock a product page behind a customer tag, so only wholesale buyers see your wholesale catalog. You can require a password to access a collection, which works well for private sales. You can restrict access based on location, customer account status, or even specific dates.

For these use cases, Locksmith works exactly as intended. If you need to hide a page from people who should not see it, Locksmith does that reliably.

The problem appears when you try to use page visibility as a proxy for purchase restriction. Hiding a product page is not the same as preventing a purchase.

The bypass problem

Shopify stores are not just product pages. There are multiple paths to adding a product to a cart, and not all of them go through the product page.

Direct cart URLs. Every Shopify product has a variant ID. Anyone who knows the ID (or finds it in a cached page, a shared link, or a Google result) can construct a URL like yourstore.com/cart/VARIANT_ID:1 and add the product directly to their cart. Locksmith does not intercept this because the customer never visits the locked page.

AJAX Cart API. Shopify's Storefront API and AJAX Cart API allow products to be added to the cart programmatically. A technically inclined customer, or a simple browser extension, can call /cart/add.js with the product variant and bypass the product page entirely.

Shared links and cached pages. If a legitimate customer shares a direct link to the product, or if Google has cached the page from before it was locked, someone can reach the product without hitting Locksmith's conditions.

Theme-level collection pages. Depending on your theme, products may appear in collection grids, search results, or recommendation widgets without the customer ever visiting the individual product page. Quick-add buttons on collection pages can bypass page-level locks entirely.

None of these bypasses are bugs in Locksmith. They are a consequence of where Locksmith operates. Page-level access control cannot cover every path to the cart. And once a product is in the cart, there is nothing between the customer and the checkout.

For a deeper look at why frontend-level protections fall short, see How to Block Products at Checkout Based on Purchase History.

Where OfferGuard operates

OfferGuard does not touch the product page. Anyone can browse, view, and add a protected product to their cart. The restriction happens at checkout, after the customer enters their information and before payment is processed.

At that point, five identity signals are checked against previous buyers of the protected product:

• Email normalization strips aliases, dot tricks, and flags throwaway providers
• Phone matching compares against previous purchasers
• Address fuzzy matching identifies the same household across formatting variations
• IP validation flags repeat networks
• Device fingerprinting recognizes returning browsers, even in incognito mode

This runs through Shopify Functions, server-side. There is no JavaScript to disable, no page to bypass, and no URL trick that skips the check. Every checkout that contains a protected product goes through validation.

The customer experience is straightforward. If they are a first-time buyer, checkout proceeds normally. If they have bought the product before, they see a message explaining that the product is restricted to new customers. No charge, no order, no confusion.

Feature by Feature

| Feature | Locksmith | OfferGuard | |---|---|---| | Protection point | Product page (visibility) | Checkout (purchase) | | Can be bypassed via direct cart URL | Yes | No | | Can be bypassed via AJAX API | Yes | No | | Works in incognito | Depends on condition type | Yes (device fingerprinting) | | Guest checkout coverage | Limited (many conditions require accounts) | Full | | Email normalization | No | Yes | | Device fingerprinting | No | Yes | | Address matching | No | Yes | | Product-level restrictions | Yes (page-level) | Yes (checkout-level) | | Wholesale/membership gating | Excellent | Not designed for this | | Content/page hiding | Core feature | Not available | | Setup | Configure lock conditions per page | Select products to protect |

When Locksmith is the better choice

If your goal is controlling who can see a product, Locksmith is the better tool. Specific scenarios where Locksmith makes more sense:

Wholesale catalogs. You want tagged wholesale customers to see wholesale pricing, and everyone else to see retail. Locksmith handles this cleanly with customer tag conditions.

Membership content. You sell access to exclusive content or digital products and want to gate pages behind a membership check. Locksmith integrates with membership apps to do exactly this.

Private sales and launches. You want to hide an upcoming collection behind a password until a specific date. Locksmith's date-based and password-based locks work well here.

Location-based restrictions. You need to restrict certain products to specific regions based on compliance or shipping constraints. Locksmith's location conditions handle this.

In all of these cases, the goal is visibility control. Locksmith does visibility control well.

When OfferGuard is the better choice

If your goal is preventing repeat purchases of a specific product, OfferGuard is the better tool. This applies to:

New-customer-only products. Trial boxes, intro offers, starter kits, and first-purchase-only items where the business model depends on each customer buying once.

Loss-leader products. Items priced below cost to acquire new customers. If returning customers keep buying them, you are losing money on your own customer base.

Subscription intro pricing. First-month discounts that should only apply once per household, not once per email address.

In these cases, the goal is not hiding the product. You want new customers to find it easily. You just do not want existing customers to buy it again. That is a checkout problem, not a page visibility problem.

For a complete breakdown of how to protect these products, see The Complete Guide to Protecting New-Customer-Only Products on Shopify. And for a look at how incognito mode bypasses many frontend protections, see Shopify Incognito Checkout Bypass.

Different problems, different tools

Locksmith and OfferGuard are not really competitors. They solve different problems at different layers of your store.

If you need to hide pages, use Locksmith. If you need to block purchases, use OfferGuard. Some merchants use both: Locksmith to manage their wholesale catalog, OfferGuard to protect their trial products at checkout.

The mistake is assuming that hiding a product page is the same as preventing a purchase. On Shopify, there are too many paths to the cart for page-level locks to be airtight. Checkout-level blocking closes the gap.

See OfferGuard pricing and start a free trial →