0

I'm creating pages in a portal that are all available to the user but every page is password protected. The user will receive an email ea. month with the password for that months page to view the content.

By default, Wordpress does the following (this is from their codex page):

WordPress will only track one password at a time. Therefore, if two posts use two different passwords, entering the password for post A, then entering the password for post B means that revisiting post A (or any post which shares its password) will require the user to re-enter the password for post A.

My question is if there is a way to make it so multiple passwords are stored in the browser cookie so that when the user revisits post A (in the example above) they will not have to re-enter the password. Ideally, I'd like it to store all of the passwords for all of the separate password protected pages so that once the user enters the password the first time, they won't have to ever enter it again (unless of course they clear browser cookies).

Thanks for your help!

3 Answers 3

0

Rather than changing passwords on the posts/pages themselves, you could reset the users' passwords every month. You would set up your posts/pages/CPTs such that only logged-in users of a certain role could view the pages you want to protect, assign everyone that role, and email them their monthly password. That way, when they try to view a page, they're sent over to the login form; they must enter the current password to view any of the pages; and once they're logged in they can view all the protected content.

1
  • I appreciate the offer for a work-around, but I'm using a portal plugin that is already highly customized and entirely automated. The user is already logged in at this point so changing the password wouldn't provide a solution.
    – Jesse
    Apr 16, 2018 at 18:56
0

On page load (template_redirect) you could check for a sent password in $_POST and save it to an extra cookie. Then you´d have to hook into https://developer.wordpress.org/reference/functions/post_password_required/ and return false if a password in your cookie fits.

0

Customizing WordPress to store multiple passwords for different password-protected posts in the browser's cookies is a bit complex and would require custom coding. WordPress, by default, doesn't support this functionality for security reasons. However, you can achieve this by developing a custom plugin or adding custom code to your theme's functions.php file.

Here’s a general approach to implement this:

1. Custom Cookie Management Set a Custom Cookie: When a user enters a password for a password-protected page, set a custom cookie that stores this password. Manage Multiple Passwords: Store the passwords in an array or a serialized format within the cookie. Each password can be associated with its post ID for reference.

2. Custom Password Verification Modify Password Verification: Intercept WordPress’s default password verification process. Before it checks the WordPress default password cookie, your code should verify if the correct password for the current post exists in your custom cookie. Auto-fill Password: If the correct password is found in your custom cookie, automatically fill it in and grant access.

3. Security Considerations Encryption: Consider encrypting the passwords stored in the cookie. Cookie Expiration: Set an expiration for the cookie. This could be a fixed time, like 30 days, or based on the last access. Clearing Old Passwords: Implement logic to clear old or unused passwords from the cookie.

Example Code Snippet

Here's a basic structure of how you might set up the cookie. This is a simplified example for illustration purposes:

function wpb_custom_password_cookie() {
    if (isset($_POST['post_password'])) {
        // Assuming each post has a unique ID
        $post_id = get_the_ID(); 
        $cookie_name = 'wpb_custom_passwords';

        // Get existing passwords from the cookie
        $passwords = (isset($_COOKIE[$cookie_name])) ? unserialize($_COOKIE[$cookie_name]) : array();

        // Set the password for this post in the array
        $passwords[$post_id] = esc_attr($_POST['post_password']);

        // Save the updated array back to the cookie
        setcookie($cookie_name, serialize($passwords), time() + 86400 * 30, COOKIEPATH, COOKIE_DOMAIN, is_ssl());
    }
}
add_action('init', 'wpb_custom_password_cookie');

Customizing the Verification Process

To customize the password verification process, you will need to hook into WordPress’s password protection mechanism. This can be quite complex, as you'll need to intercept the default behavior and implement your own password checking logic.

Caveats and Recommendations

Security: Storing passwords in cookies, even in an encrypted form, poses security risks. Always consider the implications and ensure your method is secure.

User Experience: Consider the user experience and the potential confusion if users access the site from different devices or browsers. Testing: Thoroughly test this functionality, especially to ensure that security isn't compromised.

Since this is a custom solution, it may require maintenance and updates with WordPress core updates to ensure compatibility and security. As a WordPress and PHP developer, you might find this within your skill set, but consider consulting with a security expert to ensure the implementation is as secure as possible.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.