GIL Waiting Room

What happens when a sale, a campaign, or a viral post sends more visitors than your server can comfortably handle? GIL Waiting Room creates a virtual waiting room in front of your site. You choose how many visitors may browse at the same time; everyone above that limit is placed in a fair, first-come-first-served queue and sees a clean lobby page with their live position and an estimated wait. As soon as a spot opens, the next visitor in line is admitted automatically, no refresh or action needed. How it works

• Each visitor gets a signed, HttpOnly cookie so their place in line survives reloads and short absences.
• Admission is atomic at the database level, so the limit holds even under bursts of concurrent traffic.
• Admitted visitors keep their spot for a session length you configure; when it expires, the spot goes to the next person in line.
• The lobby page polls a lightweight status endpoint every few seconds, shows live progress, and lets the visitor in the moment they are admitted.
• The lobby adapts to the visitor's light or dark system theme, respects reduced-motion preferences, and announces progress to screen readers.
• Preview the waiting room from the settings page before enabling it, and watch live admitted/waiting counts during a spike.
• The lobby is served with HTTP 503 and a Retry-After header, so search engines understand the site is temporarily busy and do not index the lobby.
• Administrators are never gated, so you cannot lock yourself out.

What this plugin is not GIL Waiting Room manages capacity, it is not DDoS protection. Requests still reach PHP; the plugin decides who may browse. If you are under attack, you need protection at the network or CDN layer. If a full-page cache or CDN serves your pages without hitting PHP, those cached hits cannot be queued. The waiting room works for requests that reach WordPress.

2.0.1

• The lobby page now loads its CSS and JavaScript through wp_enqueue_style() and wp_enqueue_script() instead of inline blocks.
• Fixed the lobby favicon, which was stripped and rendered as an empty reference.

2.0.0

• Complete rework of the admission engine: atomic admission under a database lock, FIFO promotion, and a fatal-error fix at exact capacity.
• Visitor identity moved from PHP sessions to a signed, HttpOnly cookie.
• New lobby page: self-contained, served with HTTP 503 and Retry-After, polls a REST status endpoint and admits automatically.
• Administrators are never gated.
• Queue clearing is now nonce-protected; settings are validated server-side.
• All external assets removed; everything ships with the plugin.
• Redesigned lobby (light/dark themes, progress bar, reduced-motion and screen-reader support) and settings page (live-updating counts, status line, lobby preview).

1.0.0

• Initial release.