User Directory without a Plugin

Question

GOAL: Develop a password-protected user directory without a membership plugin. The login credentials are the same for everyone.

QUESTION: Will this strategy keep the info private, or am I missing something?

1. Create a custom post type with options:

   'public' => true,
   'has_archive' => false,
   'exclude_from_search' => true,
   'publicly_queryable'  => false,
   

2. create a password-protected page with a custom page template, displaying the custom post type query (the list of addresses).

3. add a password form to the custom page template, like so:

   global $post;
   get_header();
   if ( ! post_password_required( $post ) ) {
       // …
   } else {
       echo get_the_password_form(); 
   }
   

Additional Notes:

• Custom Post Type paired with Advanced Custom Fields will set up fields for address, phone numbers, names, etc.
• An editor (or two) will keep the directory up to date

Answer 1

You might want to read this post about passwords protected posts. In short: Do not use them.

QUESTION: Will this strategy keep the info private, or am I missing something?

No, it won't. It will even leak info to search engines and index those.

What you can do is to just require the actual user login in your template:

// @link https://developer.wordpress.org/reference/functions/is_user_logged_in/
if ( ! is_user_logged_in() ) {
    // @link https://developer.wordpress.org/reference/functions/wp_login_form/
    wp_login_form();

    // "outer template"
    wp_footer(); # etc.
    return;
}
// Other template code