Requiring a Visitor to Enter a Password Each Time They visit a Page

Question

the pandemic has changed my role within my company so that I'm now doing all of our WordPress development, despite having zero training with WordPress. Feel free to include any comments about my boss' lack of wisdom if you like!

Anyway, what I'm trying to accomplish is to create a page that is password-protected. A visitor that knows the password can enter it and view the content. So far, so good. I figured that out and was even able to customize the look of the login screen so it isn't as ugly as the default.

The client, however, asked that I configure the page so that if a visitor leaves the page, they are required to re-enter the password to get back to the content. There seem to be a fair number of possible solutions, but I can't seem to make any of them work. The code that I seem to keep finding is some variation of this:

function wpse_191369_post_password_expires() {
    return time() + 10; // Expire in 10 seconds
}

add_filter( 'post_password_expires', 'wpse_191369_post_password_expires' );

I've plugged this into my child theme's functions.php, and tested in incognito mode on Chrome. I can sign in once and view the content but if I try opening up a new incognito tab or window, I can still access the content without entering the password.

I'm sure the solution is painfully obvious, but I'm a novice here and am really just stumbling around in the dark!

Thanks in advance for any the advice!

Answer 1

On the back-end (in the admin area), you can set password protection on a per page basis. Go here to learn about that.

Next, the filter to which you refer is the correct one. Simply return when it is to expire in relation to right now.

add_filter('post_password_expires', function($time) { 
    return time() + 1;  // NOW + 1 second
});

As for the hitting the back button, you are getting a cached page that has been stored on your local machine. To get around this, you need to tell the local computer to ditch the old page and retrieve it off the server. A discussion on this has already been had. But, you still need to figure out where in the WordPress process you want to enter (hook into). Depending on how you output the headers, you can use the wp_head hook to output via HTML or the init hook to use the header() method. Shoot, you could even use the wp_headers hook and just return a whole array of them.

After you do this, you'll have to clear your local machine's cache so that you retrive a newly generated page with the new header information from the server (and don't use your old page on your local machine). Happy coding!