Is there a way to add an "incorrect password" error message on password protected pages?

I've looked everywhere and the closest thing I can find is from here: Add error message on password protected page

The problem is that the error persists even when you navigate away from the page because it's based on cookies.

Something that seemed so simple is taking me hours to find a solution =\


Here's a combination of these two great answers (21697 & 71284) to similar questions.

wpse241424_check_post_pass() runs early on the wp hook on single password protected pages. If an invalid password is entered, the INVALID_POST_PASS constant is set for use later in the form, and the password entry error cookie is removed to prevent the error message from being visible each time.

wpse241424_post_password_message() is run right before rendering the password form. It checks for the INVALID_POST_PASS constant that it set earlier when an invalid password is encountered, and adds the error message to the form.

function wpse241424_check_post_pass() {

    if ( ! is_single() || ! post_password_required() ) {

    if ( isset( $_COOKIE['wp-postpass_' . COOKIEHASH ] ) ) {
        define( 'INVALID_POST_PASS', true );

        // Tell the browser to remove the cookie so the message doesn't show up every time
        setcookie( 'wp-postpass_' . COOKIEHASH, NULL, -1, COOKIEPATH );
add_action( 'wp', 'wpse241424_check_post_pass' );

 * Add a message to the password form if an invalid password has been entered.
 * @wp-hook the_password_form
 * @param   string $form
 * @return  string
function wpse241424_post_password_message( $form ) {
    if ( ! defined( 'INVALID_POST_PASS' ) ) {
        return $form;

    // Translate and escape.
    $msg = esc_html__( 'Sorry, your password is wrong.', 'your_text_domain' );

    // We have a cookie, but it doesn’t match the password.
    $msg = "<p class='custom-password-message'>$msg</p>";

    return $msg . $form;
add_filter( 'the_password_form', 'wpse241424_post_password_message' );
  • I think the cookie stores the hashed password, not the raw password as suggested by the other linked answer. This might have been different in older versions? – birgire Oct 3 '16 at 23:11
  • 1
    I wonder if two hooks are needed, but it's getting late here so I'm off for now. ( ps: there's an unused global $post in the snippet ) – birgire Oct 3 '16 at 23:45
  • 1
    Thanks @birgire, you're right! Per the change log in WP v3.4: "Hash post password in cookies". – Dave Romsey Oct 3 '16 at 23:51

I have not tested the code but it seems this is what you are looking for - add the snippet on your functions.php and change the "message" accordingly. Happy coding :)

<?php add_filter( 'the_password_form', 'custom_password_form' );
function custom_password_form() {
global $post;
$label = 'pwbox-'.(empty($post->ID) ? rand() : $post->ID);
$output = '<form action="' . get_option('siteurl') . '/wp-pass.php"  method="post">
<p>' . __("This section of the site is password protected. To view it please enter your password below:") . '</p>
<p><label for="' . $label . '">' . __("Password:") . ' <input name="post_password" id="' . $label . '" type="password" size="20" /></label> <input type="submit" name="Submit" value="' . esc_attr__("Submit") . '" /></p>

   if (isset($_COOKIE['wp-postpass_' . COOKIEHASH])
    and $_COOKIE['wp-postpass_' . COOKIEHASH] != $post->post_password){ ?>
    <p style="color:#C00;">Password Invalid, please try again.</p>

 <?php } else { ?>
  • Please add some explanation to your code snippet, thanks. It looks like it would give PHP error, because of the else { part at the end. Does the cookie store the raw password value? – birgire Oct 3 '16 at 23:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.