the pandemic has changed my role within my company so that I'm now doing all of our WordPress development, despite having zero training with WordPress. Feel free to include any comments about my boss' lack of wisdom if you like!

Anyway, what I'm trying to accomplish is to create a page that is password-protected. A visitor that knows the password can enter it and view the content. So far, so good. I figured that out and was even able to customize the look of the login screen so it isn't as ugly as the default.

The client, however, asked that I configure the page so that if a visitor leaves the page, they are required to re-enter the password to get back to the content. There seem to be a fair number of possible solutions, but I can't seem to make any of them work. The code that I seem to keep finding is some variation of this:

function wpse_191369_post_password_expires() {
    return time() + 10; // Expire in 10 seconds

add_filter( 'post_password_expires', 'wpse_191369_post_password_expires' );

I've plugged this into my child theme's functions.php, and tested in incognito mode on Chrome. I can sign in once and view the content but if I try opening up a new incognito tab or window, I can still access the content without entering the password.

I'm sure the solution is painfully obvious, but I'm a novice here and am really just stumbling around in the dark!

Thanks in advance for any the advice!

  • By default the cookie allowing access will expire after 10 days, what your code is doing is changing that expiry to 10 seconds. So if you reopen the page in 10 seconds time it should ask for the password again. It may be that you still have cookies with the old expiry time so I'd recommend clearing any cookies and trying to test again. – Sephsekla May 28 '20 at 16:10
  • Thanks! It ended up working and I was able to set the expiration time to 1 second so that it's nearly instantaneous. Setting it to 0 got me stuck in a loop on the login page. The one instance that I've tested where I don't get challenged for the password again is when I load a new site in the same browser tab and then hit back. In this circumstance it seems like a cookie is still active and remembers that I'm logged in. Any advice for this situation? – Adam Nelson May 28 '20 at 17:19

On the back-end (in the admin area), you can set password protection on a per page basis. Go here to learn about that.

Next, the filter to which you refer is the correct one. Simply return when it is to expire in relation to right now.

add_filter('post_password_expires', function($time) { 
    return time() + 1;  // NOW + 1 second

As for the hitting the back button, you are getting a cached page that has been stored on your local machine. To get around this, you need to tell the local computer to ditch the old page and retrieve it off the server. A discussion on this has already been had. But, you still need to figure out where in the WordPress process you want to enter (hook into). Depending on how you output the headers, you can use the wp_head hook to output via HTML or the init hook to use the header() method. Shoot, you could even use the wp_headers hook and just return a whole array of them.

After you do this, you'll have to clear your local machine's cache so that you retrive a newly generated page with the new header information from the server (and don't use your old page on your local machine). Happy coding!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.