I'm using the Wordpress password page protection feature to secure some pages up on a site I am working on. It is part of a large multisite installation and that's why I do not want to anywhere near hooking into WP Users table (less vector surfaces for infiltration) as it will potentially adversely effect other sites.

The content itself is not premium or paid content, it is just sensitive in nature. What I want to be able to do is have some pages setup with password protection and if/when visitor accesses those pages, they are forcefully redirected to a login page. Got that sorted here:

    <?php if ( !post_password_required() ) {
        echo 'this page is available for everyone to see';
    } else if ( post_password_required() && !is_page( 143 ) ) {
        echo 'This page is password protected';
        wp_redirect( home_url( '/rm_login/' ) );

It's a first 'rough cut'. My core issue is that I want to replace out the primary nav with a 'protected' version of the menu when WP can detect that the user has effectively 'unlocked' the secure pages. My code:

function my_wp_nav_menu_args( $args = '' ) {
global $post;
    if( !post_password_required() ) {
        $args['menu'] = 'Primary-menu';
    } else {
        $args['menu'] = 'Protected-menu';
    return $args;
add_filter( 'wp_nav_menu_args', 'my_wp_nav_menu_args' );

But what this does is swap out with the protected menu when the user hits the 'login' page. I know my code just detects if password is required on the page and that's why it is happening - but is there another condition I can check to validate/verify that has already unlocked the page(s)?

I'm aware this method stores a JS cookie, but it looks randomised and expires fairly quickly (and doing any sort of checks on JS is kinda 'flaky').

It does the same thing when I use empty( $post->post_password ) to check condition. All these conditions check for 'password required' but can any check for 'password entered'??

  • post_password_required() is false if the user has unlocked the post/page. – Jacob Peattie Oct 20 '17 at 4:21
  • Yeah but the same result occurs when a user accesses a page that is not locked at all - which is why I'm having a hard time trying to distinguish from these two states... – Ryan Coolwebs Oct 20 '17 at 6:27

If you want to check if a post has a password, and that the password has been entered, check both post_password_required() and $post->post_password:

$post = get_queried_object();

if ( ! post_password_required( $post ) && ! empty( $post->post_password ) ) {
    // Post has a password, but has been entered.
  • Ahhh... I see what you were hinting at before. Thanks man. I used your suggestions and a few more else if variations and I think I have it figured out. – Ryan Coolwebs Oct 20 '17 at 8:17
  • Here's a 'curly' one. What about showing the 'protected' menu when the user has logged in but viewing a page that is not protected? – Ryan Coolwebs Oct 20 '17 at 8:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.