0

I have a password protected page and I'd like to get it accessible also with a direct link with the password in url.

I found this solution, and it works perfectly unless you try to access the page the usual way through the default password form. In this case you get notices like Undefined index: pwd.

Same notices in admin dashboard. I fixed this by adding if is_admin() condition, but not the previous issue.

Any suggestion will be highly appreciated.

2 Answers 2

2

In case somebody needs help about my topic, I've fixed the notice error by modifying the original code as following:

// BYPASS PASSWORD PRETECTED PAGE URL
add_filter( 'post_password_required', function( $returned, $post ) {   
if ( !is_admin() ) {
    if (strpos($_SERVER['REQUEST_URI'], 'pwd') !== false){  
        if( $returned && ( $_GET['pwd'] ==  $post->post_password ) )
            $returned = false;          
    }   
} else {        
    $returned = true;   
}
return $returned;
}, 10, 2 );
1
  • Thanks ! I've been looking for a simple solution to this problem for hours now, and I'm pretty sad (to say it politely) to see the vast amount of expensive plugins and their paid(?) recommendation blog posts everywhere. For those who aren't too familiar with WP, this code needs to be added to the functions.php file of the theme (kinsta.com/blog/wordpress-functions-php) Apr 9 at 18:30
0

What you're trying to accomplish poses a significant security risk and is generally not advised. Passing passwords via URL can expose sensitive information because URLs are logged in various places like browser history, network routers, and server logs.

However, if you're aware of these security implications and you have a valid use case for this, there is a possible solution you could consider: instead of passing the actual password in the URL, pass a uniquely generated token that maps to the password on the server side.

Here's a rough idea of how this could be done:

  1. Generate a unique token for each password protected page. You could store these tokens in the database and associate each with the appropriate page.

  2. When a user accesses a page via the special URL containing the token, your code intercepts the request, checks the token against the database, and if it matches, it programmatically submits the password and bypasses the password form.

  3. If the user accesses the page via the normal URL, they would be presented with the password form as usual, since no token is being passed.

This is still not an ideal solution and would require quite a bit of custom code to implement correctly. Furthermore, it still presents a security risk as tokens could be intercepted and used by unauthorized individuals.

If you need to share access to password protected content with several users, you might want to consider using a membership plugin or a user role management plugin, which could provide a more secure way to manage access.

1
  • You are right, but it depends on the content you use the simple password to. In my case there's no sensitive information, just a few files (prices, list of distributors) and I just want to share this frontend page with a restricted group of visitors. So using the url with password has the same risk than using the password itself. Honestly I consider more potentially dangerous to activate dozens of user accounts (even if with low permissions). May 30, 2023 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.