Add error message on password protected pages

Question

Is there a way to add an "incorrect password" error message on password protected pages?

I've looked everywhere and the closest thing I can find is from here: Add error message on password protected page

The problem is that the error persists even when you navigate away from the page because it's based on cookies.

Something that seemed so simple is taking me hours to find a solution =\

Answer 1

Here's a combination of these two great answers (21697 & 71284) to similar questions.

wpse241424_check_post_pass() runs early on the wp hook on single password protected pages. If an invalid password is entered, the INVALID_POST_PASS constant is set for use later in the form, and the password entry error cookie is removed to prevent the error message from being visible each time.

wpse241424_post_password_message() is run right before rendering the password form. It checks for the INVALID_POST_PASS constant that it set earlier when an invalid password is encountered, and adds the error message to the form.

function wpse241424_check_post_pass() {

    if ( ! is_single() || ! post_password_required() ) {
        return;
    }

    if ( isset( $_COOKIE['wp-postpass_' . COOKIEHASH ] ) ) {
        define( 'INVALID_POST_PASS', true );

        // Tell the browser to remove the cookie so the message doesn't show up every time
        setcookie( 'wp-postpass_' . COOKIEHASH, NULL, -1, COOKIEPATH );
    }
}
add_action( 'wp', 'wpse241424_check_post_pass' );


/**
 * Add a message to the password form if an invalid password has been entered.
 *
 * @wp-hook the_password_form
 * @param   string $form
 * @return  string
 */
function wpse241424_post_password_message( $form ) {
    if ( ! defined( 'INVALID_POST_PASS' ) ) {
        return $form;
    }

    // Translate and escape.
    $msg = esc_html__( 'Sorry, your password is wrong.', 'your_text_domain' );

    // We have a cookie, but it doesn’t match the password.
    $msg = "<p class='custom-password-message'>$msg</p>";

    return $msg . $form;
}
add_filter( 'the_password_form', 'wpse241424_post_password_message' );

Answer 2

This worked for me:

add_filter( 'the_password_form', 'wpse_71284_custom_post_password_msg' );

/**
 * Add a message to the password form.
 *
 * @wp-hook the_password_form
 * @param   string $form
 * @return  string
 */
function wpse_71284_custom_post_password_msg( $form )
{
    // No cookie, the user has not sent anything until now.
    if ( ! isset ( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] ) )
        return $form;

    // Translate and escape.
    $msg = esc_html__( 'La contraseña es incorrecta o ya ha sido utilizada.', 'your_text_domain' );

    // We have a cookie, but it doesn’t match the password.
    $msg = "<p class='custom-password-message'>$msg</p>";

    return $msg . $form;
}

add_action('init', 'myStartSession', 1);
add_action('wp_logout', 'myEndSession');
add_action('wp_login', 'myEndSession');
function myStartSession() {
    if(!session_id()) {
        session_start();
    }
}
function myEndSession() {
    session_destroy ();
}


if ( post_password_required() ) {
       $session_id = 'wp-postpass_' . get_the_ID();
       //onload
       $current_cookie = wp_unslash($_COOKIE[ 'wp-postpass_' . COOKIEHASH ]);
       //get old cookie 
       $old_cookie = isset( $_SESSION[ $session_id ] ) ? $_SESSION[ $session_id ] : '';
       //set new session
       $_SESSION[ $session_id ] = $current_cookie;
       if ( $current_cookie != $old_cookie && !empty( $old_cookie ) ){
           error_notification('<b>Error!</b> Authentication failed!');
       }
   }
?>

Answer 3

I have not tested the code but it seems this is what you are looking for - add the snippet on your functions.php and change the "message" accordingly. Happy coding :)

<?php add_filter( 'the_password_form', 'custom_password_form' );
function custom_password_form() {
global $post;
$label = 'pwbox-'.(empty($post->ID) ? rand() : $post->ID);
$output = '<form action="' . get_option('siteurl') . '/wp-pass.php"  method="post">
<p>' . __("This section of the site is password protected. To view it please enter your password below:") . '</p>
<p><label for="' . $label . '">' . __("Password:") . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__("Submit") . '" /></p>
</form>';

   if (isset($_COOKIE['wp-postpass_' . COOKIEHASH])
    and $_COOKIE['wp-postpass_' . COOKIEHASH] != $post->post_password){ ?>
    <p style="color:#C00;">Password Invalid, please try again.</p>

 <?php } else { ?>