WordPress Development Stack Exchange is a question and answer site for WordPress developers and administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I protected a page with password. I’d like to add a short error message when the inserted password is incorrect.

How can I do this?

I add this code to show and customize the form on my page.

My functions.php

add_filter( 'the_password_form', 'custom_password_form' );
function custom_password_form() {
global $post;
$label = 'pwbox-'.( empty( $post->ID ) ? rand() : $post->ID );
$o = '<form class="protected-post-form" action="' . get_option('siteurl') . '/wp-pass.php" method="post">' . 
'<p class="glossar-form-p">Alle weiteren Glossarbeiträge sind durch ein Passwort geschützt. </p>' . 
' <label for="' . $label . '">' . ' </label><input name="post_password" id="' . $label . '" type="password" size="20" />
<input type="submit" name="Submit" value="' . esc_attr__( "Login" ) . '" />
return $o;
share|improve this question
up vote 5 down vote accepted

The latest entered password is stored as a secure hash in a cookie named 'wp-postpass_' . COOKIEHASH.

When the password form is called, that cookie has been validated already by WordPress. So you just have to check if that cookie exists: If it does and the password form is displayed, the password was wrong.

add_filter( 'the_password_form', 'wpse_71284_custom_post_password_msg' );

 * Add a message to the password form.
 * @wp-hook the_password_form
 * @param   string $form
 * @return  string
function wpse_71284_custom_post_password_msg( $form )
    // No cookie, the user has not sent anything until now.
    if ( ! isset ( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] ) )
        return $form;

    // Translate and escape.
    $msg = esc_html__( 'Sorry, your password is wrong.', 'your_text_domain' );

    // We have a cookie, but it doesn’t match the password.
    $msg = "<p class='custom-password-message'>$msg</p>";

    return $msg . $form;
share|improve this answer
One issue I've found with this approach is that if you enter the wrong password the error message will persist even if you navigate away from the page and then come back, the simplest way I've found around this is to show the message only if (wp_get_referer() == get_permalink()) – javiervd May 29 '14 at 13:50

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.