I need to build a website for a client where the can password protect certain pages and posts on the front end. So, a visitor is required to enter a password on these pages / posts.

Having searched and tried out a couple of plugins 'password protected' and 'smart passworded pages' without much success.

I was wondering if there is a way to set the wordpress built in password protect password globally. So the client only has to select if they want the page / post protected and not have to enter the password each time... which is not an option here.

Also, as they will be changing the password each term being able to do so from a single place would be great!

If anyone can point me in the right direction that would be a great help.

Many thanks


2 Answers 2


I've used the following to protect individual pages: First add a field to the Publish Metabox:

add_action( 'post_submitbox_misc_actions', 'my_post_submitbox_misc_actions1' );

function my_post_submitbox_misc_actions1(){

    echo '<div class="misc-pub-section my-options">
    <input type="checkbox" id="fgpsn_protected_content" name="fgpsn_protected_content" value="true"';

    if ( get_post_meta(get_the_ID(), 'fgpsn_protected_content', true) == 'true' ){ echo ' checked'; }
    echo '>
    <label for="fgpsn_protected_content">FGPSN Content</label></div>';


Then save the meta data - the one flaw currently is that the post must be save first. Then you can check and save the box.

add_action( 'save_post', 'fgpsn_protect_content_save' );
function fgpsn_protect_content_save($post_id)

            if ( defined( 'DOING_AUTOSAVE' ) && DOING_AUTOSAVE )

            if ( 'page' == $_POST['post_type'] ) {
                if ( !current_user_can( 'edit_page', $post_id ) )
            } else {
                if ( !current_user_can( 'edit_post', $post_id ) )

            /* check if the custom field is submitted (checkboxes that aren't marked, aren't submitted) */

                update_post_meta($post_id, 'fgpsn_protected_content', $_POST['fgpsn_protected_content']);
                //add_post_meta($postid, 'fgpsn_update_zillow_feed_result', 1, true );

                update_post_meta($post_id, 'fgpsn_protected_content', 'false');


Finally, add the check:

add_action( 'get_header', 'site_access_filter' );
function site_access_filter() {

    if ( get_post_meta(get_the_ID(), 'fgpsn_protected_content', true) == 'true' &&  is_user_logged_in() === false ) {
        wp_redirect( 'http://fgpsn.com/login' ); exit;



Obviously, I redirect users to the login page but you could manage this anyway you want from here.


You could create a template, which then should be choosen for protected sites. There you just copy the default template, and add a custom login check:

<?php if ( !is_user_logged_in() ) :
  if ( 'failed' == get_query_var( 'login', '' ) ) :
    <h2 class="red">Wrong credentials !</h2>
  wp_login_form( $args );
endif; ?>

Needs some more for error handling etc ... You can see a reference for the $args here.

And add this to funcitons.php for your custom query var:

function my_front_end_login_fail( $username ) {
     $referrer = wp_get_referer();
     if ( !empty($referrer) && !strstr($referrer,'wp-login') && !strstr($referrer,'wp-admin')     ) {
          if (!strstr($referrer,'?login=failed')) {
            $referrer .= '?login=failed';
          wp_redirect( $referrer );
add_action( 'wp_login_failed', 'my_front_end_login_fail' );

function add_query_vars_filter( $vars ){
  $vars[] = 'login';
  return $vars;
add_filter( 'query_vars', 'add_query_vars_filter' );

And, this would require, that you create a general user, which could be used to login.

You could also go with post_password_required() instead of user_is_logged_in().

Not the answer you're looking for? Browse other questions tagged or ask your own question.