diff --git a/internal/util/util.go b/internal/util/util.go
index 03b943b..971147c 100644
--- a/internal/util/util.go
+++ b/internal/util/util.go
@@ -10,7 +10,7 @@ import (
 	"strings"
 )
 
-const DevMode = true
+const DevMode = false
 
 func FormatBytes(bytes int64) string {
 	const (
diff --git a/web/main.go b/web/main.go
index f8fdc8d..fd88203 100644
--- a/web/main.go
+++ b/web/main.go
@@ -271,6 +271,13 @@ func main() {
 		slug := chi.URLParam(r, "slug")
 		ipHash := util.HashIp(util.GetIP(r))
 
+		threadIdStr := chi.URLParam(r, "threadId")
+		threadId, err := strconv.Atoi(threadIdStr)
+		if err != nil {
+			http.Error(w, "Invalid thread id", http.StatusBadRequest)
+			return
+		}
+
 		// guard banned ips
 		ban, err := database.GetBan(db, ipHash)
 		if err != nil {
@@ -295,6 +302,19 @@ func main() {
 			return
 		}
 
+		// guard if thread locked
+		isLocked := true
+		row := db.QueryRow(`SELECT locked FROM threads where id = ?`, threadId)
+		if err := row.Scan(&isLocked); err != nil {
+			http.Error(w, "Failed to check if thread locked", http.StatusInternalServerError)
+			return
+		}
+
+		if isLocked {
+			http.Error(w, "This thread is locked", http.StatusForbidden)
+			return
+		}
+
 		// parse form
 		r.Body = http.MaxBytesReader(w, r.Body, util.MAX_REQUEST_BYTES)
 		if err := r.ParseMultipartForm(util.FILE_MEM_LIMIT); err != nil {
@@ -366,14 +386,6 @@ func main() {
 			thumbPath = savedThumbPath
 		}
 
-		// put post into DB
-		threadIdStr := chi.URLParam(r, "threadId")
-		threadId, err := strconv.Atoi(threadIdStr)
-		if err != nil {
-			http.Error(w, "Invalid thread id", http.StatusBadRequest)
-			return
-		}
-
 		if err := database.PutPost(db, slug, threadId, body, mediaPath, thumbPath, ipHash); err != nil {
 			http.Error(w, "Failed to create post", http.StatusInternalServerError)
 			log.Printf("PutPost: %v", err)
diff --git a/web/views/thread.templ b/web/views/thread.templ
index 831629d..a8e6dee 100644
--- a/web/views/thread.templ
+++ b/web/views/thread.templ
@@ -216,7 +216,9 @@ templ Thread(board database.Board, thread database.Thread, posts []database.Post
 		<script src="/static/thread.js" defer></script>
 		@BoardHeader(board)
 		<div class="new-post-container">
-			@shared.NewPostForm(board, fmt.Sprintf("/%s/threads/%d", board.Slug, thread.Id), false)
+			if !thread.Locked {
+				@shared.NewPostForm(board, fmt.Sprintf("/%s/threads/%d", board.Slug, thread.Id), false)
+			}
 		</div>
 		@ThreadActionBar(thread, "top")
 		<div