Hi HN, I'm Josh. WallHop is a free paywall bypass: paste an article URL (or prefix any URL with wallhop.io/) and you get the readable article without the paywall popup, ads or clutter. No signup, no extension.
I built it after 12ft.io went away. The News Media Alliance took it down in July 2025 and I missed having something I could hit from my phone.
How it works: it started as a fork of everywall/ladder (GPL-3.0) and I've modified it heavily since. Instead of relying on one trick, it chains several bypass methods per request and falls back to archive.is when they all fail, so one site blocking one technique doesn't break it.
Things that might be interesting:
- iOS Shortcut: on iPhone, tap Share > WallHop from any article in Safari or another app. This is how I use it 95% of the time.
- It works on Medium member-only posts, which 12ft never handled.
- Bookmarklet for desktop, plus /raw/<url> and /api/<url> endpoints if you want to script it.
I've tested it against most major news outlets and a bunch of local papers. It won't work everywhere. There are SOME server-side paywalls that are out of reach, and I'd rather say that up front. If you find a site that breaks, I'd love the link, and I can likely figure out a way to bypass it!
If newspapers make money literally by writing this content and asking people to pay for it, how is this website not just stealing their content wholesale?
How can you prove that AI didn't write it or that it isn't pre-scripted, government-backed propaganda? I don't know about you, but I wouldn't pay a dime for that.
> ... it chains several bypass methods per request
I'm curious what are the techniques? I'm familiar with spoofing yourself as a Googlebot, or extracting the content directly when paywall enforcement is done in client-side JS only. But surely you need more tricks than that to get around WSJ or NYTimes. Also, ironically, I assume archive.is's CAPTCHA would need bypassing to fall back to that. (but volume might be low enough you can do it with a few cookies you've established trust on)
Is it fair to say that Crawler spoofing only works on sites that don't care?
Google recommends [1] checking the reverse DNS hostname of the source IP. I don't see any room for tricks there. So if you spoof a whitelisted Crawler simply by choosing the right values for some request headers, it means the publisher's web team is either clueless or doesn't care enough, no?
News site probably want to be accessible to all search engine crawlers, not just Google, and I bet some of them don't have the reverse DNS verification method.
But also, tons of news sites also only implement the paywall in client-side JS! This is so obviously easy to bypass it seems intentional, and they just don't care about the 'hackers'. Or perhaps they've know that people that are going to use tricks to access an article are very unlikely to pay for a subscription anyway.
(I wish I could just pay $1 on demand and read a paywalled article. I'd do it all the time, but I'm quite reluctant to sign up for any forever recurring subscriptions)
Why not open source? You modified GPL-3 ladder, I don’t know whether it’s required legally but I feel it’s expected morally and important practically (since yours may get taken down).
I plan on it! In my repo, I have some stuff I wouldn't want public in it right now. I am going to clean up the repo and make the fork of the repo public!
It is required when a gift comes with obligations (as with GPL-3; it's not a "Gift Public License").
It is morally expected because we would all ideally like to live in a world where everyone understands the spirit of gifting, which will lead to a better, more just world overall.
I recommend you familiarize yourself with the GPL-3, if you build something based on a GPL-3 piece of software, it's not an 'optional' obligation. If you want to build something on an open source something and keep your derivative private, then use something that originated as BSD licensed, as Sony did with the FreeBSD kernel that ended up in the PS4 and PS5.
GPL v3.0 has a SaaS loophole. The GPL's trigger is conveyance (transferring a copy), not network access. Merely running modified GPL v3.0 code on a server and serving users over HTTP is not "conveying" under the letter of GPL v3.0, so it does not by itself obligate you to release source. This loophole was fixed in AGPL v3.
They know how to actually block this stuff if they want to.
The issue is, it comes with costs, to things like SEO.
It's not hard to lock a computer system down so only logged in users can see content. It's a lot harder to lock them down so that only logged in users AND a select few entirely unauthenticated scraping tools can see your site to assist you in promoting it while OTHERWISE people aren't able to access it.
True, several sides,
1. It's not bait and switch, you have a preview of the text and if you like continue, its upto platforms which publishes the link to mark it as paid or free - or by crowdsourcing.
2. Just because a model isn't perfect that doesn't justify a illegal or unethical action. If you don't like it, don't consume.
I agree with you on advertisements, I don't like an ad ridden internet either, but I have come around to thinking, the alternative and the incentive to ad free internet is an easier payment access
You can already pay the journalist's employer, but ultimately your dollars will be going to a hedge fund owner or eventually a billionaire like Bezos that buys up media and pays the journalist a bare minimum to keep them generating clicks.
For everyone else that doesn't pay, they'll ask their AI owned by billionaires to summarize the reporting and be satisfied.
What you're suggesting is supporting independent journalism not owned by a hedge fund or billionaire, which will eventually be acquired by capitalists unless you somehow magically convince all your neighbors that it's worth monetarily supporting for a greater good.
The people willing to pay $20/mo for AI are not as likely to pay $20/mo to support independent information sources at the same time.
>We need to find better ways to sustain great journalism while making it easy for people to pay and consume.
journalists have always been employed and funded by the rich and powerful so that they can 1) amplify good news about the rich owner 2) drown out bad news about the rich owner 3) push agendas 4) resist opposing agendas.
the concept that at one time journalists were some independent rag tag group of truth-seekers is blown away by any historical recollection of the practice.
so : no , I don't think that we need to find better ways for people to pay and consume ; I think that's entirely up to the profiteers behind the mechanism to figure out how to do.
It's never been easier in history to be a nobody and get a message out to the masses; this is one of the only times in history where a journalist can do their job without selling their souls to the devil (paraphrasing hunter thompson).
and this is ignoring recent internet history of ad-malware, person-tracking, and compulsory clickbait headlines that beg the stupidest low-IQ takes possible in order to get you to click into a paywall.
I feel very little sympathy towards industries that'll save themselves from drowning by stepping onto their customers' heads to avoid the ocean.
If I ask a public httpd for the content of a URL and it sends it to me, it's my choice to render it how I want. The fact that I might choose to disregard various CSS and overlays and javascript delivered along with the text body content is up to me.
If somebody really wants to implement a fully effective paywall they're welcome to put their content behind a fully active content generated system that requires a unique username/password, same as signing in to an airline's mileage program/ticketing system, your personal paypal account or online banking, etc. Nobody is out there building paywall bypasses that work to render the content of somebody else's Citibank account.
I strongly suspect archive.is is buying subscriptions to the big outlets with actually hard paywalls. The fact that both OP and the Magnolia1234 fall back to archive.is for the actually challenging paywalls support that. That's the difference to a Citibank account: you can't simply buy access for that.
I agree with you in that we need to support the journalists doing the reporting. That's expensive, the companies that do it are mostly in dire financial straits, and most journalists themselves make very little money.
A universal subscription is incredibly difficult to set up logistically, especially wondering how you split up payments, who qualifies to be included, etc. Is it by traffic? That would incentivize clickbait even more.
Micropayments with fiat just have a lot of friction around them. The L402 standard being developed by Lightning Labs, among others, is promising, especially in conjunction with tools like Ark and Spark that make having access to the Lightning network something that the average person can muster (even if there's a certain loss of sovereignty in doing so compared to running a full Lightning node). Assuming people wouldn't just be okay with fully custodial Lightning through providers like Speed.app, Cashapp or Strike.me (and most would).
Even if it's used for tipping rather than gating, it seems like a no-brainer for news outlets to consider putting on their pages. Trivial even to put splits in place so that a portion goes to the journalist, a portion to the editor, perhaps some to the photographer, etc.
Legacy media is just slow to move, and of course, Bitcoin isn't particularly ubiquitous. There are also initiatives such as X402 that wouldn't involve Bitcoin, though to my understanding, they do at least all require some sort of blockchain rails -- mostly stablecoins.
I think the issue is psychological rather than currency. There's a judgment a user needs to make before reading every article where they can decide it's not worth it. X401 transactions are most likely crawlers, without that issue.
I think there should be browser support where the user sets a dollar threshold to trigger payment confirmation. Below that threshold, the microtransaction is automatically authorized.
Long back I was wondering if a tip jar type service that'll get me access to what I actually want to see would be a better solution in place of subscribing to every website that produces an interesting article once in a while. There were a couple of such services but they never got popular.
Perhaps this model alone is not sustainable but it could be paired with ads (as in ads or fee off a tip jar pay). Even then, it surely won't lead to infinite growth, which is the only goal nowadays.
I'd love to see some kind of cross-publication subscription service where I pay 20 bucks a month, and I can read, say, 100 articles from the 40 largest publications.
I'd rather see something involving micropayments, likely using the Lightning network, to make viewing a single article for the cost of one viable.
And in fairness this does exist on Nostr (I think in multiple forms). It's just not widely used. Not least because most on Nostr don't really believe in the idea that information can be owned in the first place.
Micro payments should be integrated into our browsers and agents; we can just conveniently pay up for what we want to read, rather than subscribing for a whole bunch of stuff we have no interest in.
> Paywalls pay for journalism. If there’s a paper or news site you read every day, please subscribe to it. WallHop is for the one-off article someone texts you from a site you’ll never visit again.
What protection is implemented to make sure of this? Or you leave the choice to the good moral of the users?
As a data point, whatever ublock origin on firefox does to remove overlays and ads seems to be also removing the paywall on that. Indian domestic news websites are rife with the most cancerous and absurd ads so I've found they're a good test for ublock origin on firefox.
Wow you were right. That site in particular appears to have an infinite scroll of ads disguised as articles, nearly all of them with AI-generated images targetting the elderly.
It's a truly disgusting reality check to glimpse the internet as it is without uBlock every so often.
Sorry was basing that comment on a test case with an FT article, which it presented as just the text of. Does Wallhop act differently for different urls? A Verge article I just saw was presented as the full scraped html page. Different experience.
101 comments
[ 0.98 ms ] story [ 24.0 ms ] threadI built it after 12ft.io went away. The News Media Alliance took it down in July 2025 and I missed having something I could hit from my phone.
How it works: it started as a fork of everywall/ladder (GPL-3.0) and I've modified it heavily since. Instead of relying on one trick, it chains several bypass methods per request and falls back to archive.is when they all fail, so one site blocking one technique doesn't break it.
Things that might be interesting:
- iOS Shortcut: on iPhone, tap Share > WallHop from any article in Safari or another app. This is how I use it 95% of the time. - It works on Medium member-only posts, which 12ft never handled. - Bookmarklet for desktop, plus /raw/<url> and /api/<url> endpoints if you want to script it.
I've tested it against most major news outlets and a bunch of local papers. It won't work everywhere. There are SOME server-side paywalls that are out of reach, and I'd rather say that up front. If you find a site that breaks, I'd love the link, and I can likely figure out a way to bypass it!
I'm curious what are the techniques? I'm familiar with spoofing yourself as a Googlebot, or extracting the content directly when paywall enforcement is done in client-side JS only. But surely you need more tricks than that to get around WSJ or NYTimes. Also, ironically, I assume archive.is's CAPTCHA would need bypassing to fall back to that. (but volume might be low enough you can do it with a few cookies you've established trust on)
Google recommends [1] checking the reverse DNS hostname of the source IP. I don't see any room for tricks there. So if you spoof a whitelisted Crawler simply by choosing the right values for some request headers, it means the publisher's web team is either clueless or doesn't care enough, no?
[1] https://developers.google.com/crawling/docs/crawlers-fetcher...
But also, tons of news sites also only implement the paywall in client-side JS! This is so obviously easy to bypass it seems intentional, and they just don't care about the 'hackers'. Or perhaps they've know that people that are going to use tricks to access an article are very unlikely to pay for a subscription anyway.
(I wish I could just pay $1 on demand and read a paywalled article. I'd do it all the time, but I'm quite reluctant to sign up for any forever recurring subscriptions)
Why is reciprocation for a gift required? Gifts are given without obligation conferred.
It is morally expected because we would all ideally like to live in a world where everyone understands the spirit of gifting, which will lead to a better, more just world overall.
The AGPL violates the four freedoms, as well as the user’s privacy, and is thus a nonfree license.
https://wallhop.io/https://www.irishexaminer.com/opinion/col...
The issue is, it comes with costs, to things like SEO.
It's not hard to lock a computer system down so only logged in users can see content. It's a lot harder to lock them down so that only logged in users AND a select few entirely unauthenticated scraping tools can see your site to assist you in promoting it while OTHERWISE people aren't able to access it.
We need to find better ways to sustain great journalism while making it easy for people to pay and consume.
E.g Could we just have one consortium of media contents to subscribe and use it across the web for a month, than buying in each website.
I agree with you on advertisements, I don't like an ad ridden internet either, but I have come around to thinking, the alternative and the incentive to ad free internet is an easier payment access
So if you expect something to be free therefore it must be?
There are surely ethical newspapers that use paywalls, but the majority in my country (Germany) are mostly about rage bait and/or facist dogwhistles
For everyone else that doesn't pay, they'll ask their AI owned by billionaires to summarize the reporting and be satisfied.
What you're suggesting is supporting independent journalism not owned by a hedge fund or billionaire, which will eventually be acquired by capitalists unless you somehow magically convince all your neighbors that it's worth monetarily supporting for a greater good.
The people willing to pay $20/mo for AI are not as likely to pay $20/mo to support independent information sources at the same time.
Similar efforts never hit critical mass.
I have thoughts on what could work but that’s a longer topic for another day.
journalists have always been employed and funded by the rich and powerful so that they can 1) amplify good news about the rich owner 2) drown out bad news about the rich owner 3) push agendas 4) resist opposing agendas.
the concept that at one time journalists were some independent rag tag group of truth-seekers is blown away by any historical recollection of the practice.
so : no , I don't think that we need to find better ways for people to pay and consume ; I think that's entirely up to the profiteers behind the mechanism to figure out how to do.
It's never been easier in history to be a nobody and get a message out to the masses; this is one of the only times in history where a journalist can do their job without selling their souls to the devil (paraphrasing hunter thompson).
and this is ignoring recent internet history of ad-malware, person-tracking, and compulsory clickbait headlines that beg the stupidest low-IQ takes possible in order to get you to click into a paywall.
I feel very little sympathy towards industries that'll save themselves from drowning by stepping onto their customers' heads to avoid the ocean.
If I ask a public httpd for the content of a URL and it sends it to me, it's my choice to render it how I want. The fact that I might choose to disregard various CSS and overlays and javascript delivered along with the text body content is up to me.
If somebody really wants to implement a fully effective paywall they're welcome to put their content behind a fully active content generated system that requires a unique username/password, same as signing in to an airline's mileage program/ticketing system, your personal paypal account or online banking, etc. Nobody is out there building paywall bypasses that work to render the content of somebody else's Citibank account.
That said, micropayments have been tried over and over again, and fail. https://reutersinstitute.politics.ox.ac.uk/news/micropayment...
A universal subscription is incredibly difficult to set up logistically, especially wondering how you split up payments, who qualifies to be included, etc. Is it by traffic? That would incentivize clickbait even more.
I've written about my plan/thoughts here: https://blog.forth.news/a-business-model-for-21st-century-ne...
Even if it's used for tipping rather than gating, it seems like a no-brainer for news outlets to consider putting on their pages. Trivial even to put splits in place so that a portion goes to the journalist, a portion to the editor, perhaps some to the photographer, etc.
Legacy media is just slow to move, and of course, Bitcoin isn't particularly ubiquitous. There are also initiatives such as X402 that wouldn't involve Bitcoin, though to my understanding, they do at least all require some sort of blockchain rails -- mostly stablecoins.
Also, you gon' get sued.
Might have to strip articles down to just text and perhaps even use a few accounts to prevent watermarking that detects you.
OP states on their blog [1]:
> If every method fails, fall back to an archived copy from archive.is.
I'm wondering why I shouldn't just stick with archive.is then.
[1] https://dev.to/wafflehacker/12ftio-is-gone-so-i-built-my-own...
Perhaps this model alone is not sustainable but it could be paired with ads (as in ads or fee off a tip jar pay). Even then, it surely won't lead to infinite growth, which is the only goal nowadays.
And in fairness this does exist on Nostr (I think in multiple forms). It's just not widely used. Not least because most on Nostr don't really believe in the idea that information can be owned in the first place.
https://github.com/nostr-protocol/nips/pull/2156 for discussion around the NIP.
What protection is implemented to make sure of this? Or you leave the choice to the good moral of the users?
https://www.thehindu.com/news/national/tamil-nadu/two-seats-...
It's a truly disgusting reality check to glimpse the internet as it is without uBlock every so often.
It's fast, nice. But trustworthy? There's so little indication that the content hasn't been tampered with or even when it was scraped.