wpexpertsio/password-protected

Password protect your WordPress site quickly and simply

Password Protected

A very simple way to quickly password protect your WordPress site with a single password.

This plugin only protects your WordPress generated content. It does not protect images or uploaded files so if you enter and exact URL to in image file it will still be accessible.

Features include:

• Password protect your WordPress site with a single password.
• Option to allow access to feeds.
• Option to allow administrators access without entering password.
• New 👉 Now you can customize the whole password protected screen including the background, font, logo, color e.t.c.

Please note, this plugin works by setting a cookie to allow access to the site. If you are using a caching plugin or web hosting such as WP Engine that has in-built caching, you will need to configure the caching service to be disabled if the Password Protected cookie is set.

Translations

If you would like to translate this plugin you can easily contribute at the Translating WordPress page. The stable plugin needs to be 95% translated for a language file to be available to download/update via WordPress.

Installation

To install and configure this plugin...

1. Upload or install the plugin through your WordPress admin.
2. Activate the plugin via the 'Plugins' admin menu.
3. Configure the password options in the Password Protected settings.

Upgrading

If you are upgrading manually via FTP rather that through the WordPress automatic upgrade link, please de-activate and re-activate the plugin to ensure the plugin upgrades correctly.

Frequently Asked Questions

How can I change the WordPress logo to a different image?
Install and configure the Login Logo plugin by Mark Jaquith or the Uber Login Logo plugin. This will change the logo on your password entry page AND also your admin login page.

How can I enable feeds while the site is password protected?
In the settings, check the 'Allow Feeds' checkbox.

Can I prevent administrators having to enter password?
In the settings, check the 'Allow Administrators' checkbox.

I cannot preview my changes in the Theme Customizer
You must be an administrator (have the manage_options capability) and in the Password Protected settings, check the 'Allow Administrators' checkbox.

How can I log out?
Just add a "password-protected=logout" query to your URL. eg. http://www.example.com/?password-protected=logout

I have forgotten the password. How can I disable the plugin? If you go to your WordPress admin login page /wp-login.php and it shows the admin login fields, you should still be able to login and disable the plugin.

If the admin login screen insteads shows the Password Protected field, you will need to access your site via SFTP/SSH and delete the Password Protected plugin folder in the plugins folder wp-content/plugins/password-protected.

How can I redirect to a different domain name when logging out?
If passing a redirect URL using 'redirect_to' when logging out you need you may need to use the allowed domain names filter to allow redirecting to an external domain.

Where can I report bugs and issues?
Please log issues and bugs on the plugin's GitHub page. You can also submit suggested enhancements if you like.

How can I contribute?
If you can, please fork the code and submit a pull request via GitHub. If you're not comfortable using Git, then please just submit it to the issues link above.

How can I translate this plugin?
If you would like to translate this plugin you can easily contribute at the Translating WordPress page. The stable plugin needs to be 95% translated for a language file to be available to download/update via WordPress.

Upgrade Notice

2.5.3

• Improved Settings HTML structure
• Added Note regarding compatibility with login designer within dashboard

2.5.2

Made compatibility with login designer; Now you can customize the password-protected screen with the customizer using login designer plugin.

2.5

Fixes robots tag for WordPress 5.7+

2.4

Fixes to help with caching issues and favicon on login page.

2.3

Fixed an issue with "testcookie" on some hosts. Added password_protected_cookie_name and password_protected_options_page_capability filters.

2.2.5

Added password_protected_login_password_title filter to allow customizing the "Password" label on the login form.

2.2.4

Check that $_SERVER['REMOTE_ADDR'] is set.

2.2.3

Restrict REST-API-access only if password protection is active. Added viewport meta tag to login page.

2.2.2

Fix REST option and always allow access to REST API for logged in users. Change locked admin bar icon to green.

2.2.1

Fixed PHP error when calculating cookie expiration date.

2.2

Added admin bar icon to indicate wether password protection is enabled/disabled. Options to enable REST API access and show "Remember me" checkbox.

2.1

Update caching notes for WP Engine and W3 Total Cache plugin.

2.0.3

Show user's IP address beside "Allow IP Addresses" admin setting. Declare methods as public or private and use PHP5 constructors.

2.0.2

Only redirect to allowed domain names when logging out.

2.0.1

Security fix: Use a more complex password hash for cookie key.

2.0

Added 'password_protected_logout_link' shortcode and use 'password-protected-login.css' in theme folder if it exists.

1.9

Fixed "Allow Users" functionality and added option to allowed IP addresses which can bypass the password protection.

1.8

Support for adding "password-protected-login.php" in theme directory and allow filtering of the 'redirect to' URL via the 'password_protected_login_redirect_url' filter.

1.7.2

Added 'password_protected_login_redirect' filter.

1.7.1

Fix login template compatibility for WordPress 3.9

1.7

Added 'password_protected_theme_file' filter and option to allow logged in users.

1.6.2

Allow redirection to a different URL when logging out.

1.6

Added support for Uber Login Logo plugin.

1.5

Fixes an open redirect vulnerability. Settings now have own page.

1.4

Administrators can use the site without logging in. WordPress 3.5 compatible.

1.3

Allow access to feeds. Ready for translation.

1.2

Use cookies instead of sessions.

1.1

Passwords saved encrypted.

Changelog

View a list of all plugin changes in CHANGELOG.md.

password-protected's Issues

Fix expiry time to take into account user's timezone

http://wordpress.org/support/topic/cookie-expiry?replies=2#post-5456118

Also related to #10

Possible to protect uploads?

http://wordpress.org/support/topic/protect-uploads

Option to protect 404 (non-existent) pages

Currently protects everything so no 404 pages.
http://wordpress.org/support/topic/404s-are-200-with-this-plugin

Add note about caching compatibility to readme.txt

Multiple loggin attempts and blocking (idea)

http://wordpress.org/support/topic/plugin-password-protected-feature-request-login-attempt-ip-logging

Network activate

Does this plugin work over a multisite installation? I've installed it at admin level, network activated it but it doesn't appear in the individual sites' installed plugins list.

Possible to make it work with multiple passwords?

Add option to allow Admin/Super Admins to see the site by default

http://wordpress.org/support/topic/plugin-password-protected-can-break-theme-customizer

403 Forbidden Error

Hi,

I get a 403 Forbidden message when trying to access a website with the www subdomain in front. The plugin works as designed without the www in front. Please help.

Thanks!

Random 502 (Bad gateway) errors

I randomly get this error on login once password has been entered. It seems to be a redirection problem.
Happens randomly
What can I try?

Possible to load css file?

https://wordpress.org/support/topic/possible-to-set-background-picture?replies=3#post-6073388

Add hooks for adding content above/below login form

See:
http://wordpress.org/support/topic/plugin-password-protected-feature-request-easily-add-text

Respect WP_Head robots meta

I'm not sure if this is a bug or if I missed something when looking at the code. But I have my site set up as to not allow search (under WordPress' privacy setting.) this add the meta description of no-follow to all pages on the site. I'm fairly certain it is doing so via the wp_head but it looks like this plugin isn't calling wp_head anywhere.

I guess I'm wondering a few things. Why are you not calling wp_head and is there a reason to no turn off search by default in the plugins header. I feel that most (if not all) people who have a password protect site don't want it showing up in search (but I could be wrong on that)

Your thoughts are appreciated.

Update language strings for 1.7

Updated string in pot file - translation updates required.
https://github.com/benhuson/password-protected/blob/master/languages/password-protected.pot

@fxbenard @WP-Translations Thanks for your previous contributions.

There will be some new and revised strings in the next release, currently available in master branch for translation if you are able to supply any of these.

Many thanks

Timeout error after login page

I just installed this plugin and am immediately getting a timeout error after the login page. Here are some additional details:

• Using a shared hosting set up from Namecheap
• Not using any caching plugins (or any plugins other than this one)
• On Password Protected, I have the "Allow Administrators" and "Allow Logged In Users" checked

Happy to provide any additional info if it would help get this plugin working. Thanks!

Possible to protect admin too?

See:
http://wordpress.org/support/topic/plugin-password-protected-whole-site-not-protected

Logged in User Prompted to Enter Site Password

Although I have set the Protected Permissions to allow logged in users, a user that first logs into WordPress first is still met with the additional password requirement. The user's role is set to Subscriber.

I'm unsure if something is set up wrong, or my expectations are incorrect.

Use Cookies instead of sessions

WordPress does not play nicely with sessions.

Multiple Authentication Attempts

Installing the plugin on Wordpress 3.4.1 was a breeze. I then enabled password protection and changed the password.

I have to enter the password several times for it to accept and log me in to view content. When I'm asked to authenticate it might log me in on the first try, or take several attempts to authenticate. Interestingly, once I'm logged in and click on a page or post it asks me to authenticate again.

It seems to me that either the password validation processing has an issue, and/or cookie persistence isn't working properly.

That said, this plugin is EXACTLY what I was looking to do with my site! I'd love to be able to use it and see it work (wish I programmed in PHP so I could contribute).

Password Protect login URL still accessible when protection disabled

For example, visiting the URL directly shows the login form:
http://example.com/?password-protected=login

It should probably redirect to redirect URL if set, or home.

See: https://wordpress.org/support/topic/password-protection-still-visible-while-deactivated

Changing the "Password" text

Instead of showing the word "Password" I would like to add a message for my viewers here. Can you please assist?

Using 4.0.1 after entering password user returns to same login page

I am using your plug-in to require log-in to my site while I am developing it. When user enters the correct log-in password he/she just gets redirected right back to the original log-in screen. If user enters the incorrect password he/she is notified the password is incorrect. If the correct password is entered it does behave differently than if incorrect password is entered in that the correct password returns you to original login screen instead of giving you the "incorrect password" notification but still correct password does not allow entry into the site. Do you have any idea what the problem might be?
Thank you
Mark

Show error message if password incorrect.

Needs implementing.

Add whitelisting for domains as well as IP addresses.

See: https://wordpress.org/support/topic/vulnerability-open-redirect?replies=4#post-7607960

Issues with caching plugins

Need to do some checks to see if it is compatible with WP Super Cache and W3 Total cache

Wordpress 4.0

Hi there,
My site just updated to WP 4.0 and the plugin is now no longer working. No password screen comes up and anyone can access my website. Do you know of any way around this?

Sincerely,
Anne Martin

"Incorrect Password" displayed when correct password entered

When the correct password is entered "Incorrect Password" now displays, the users is then able to refresh the window and access the homepage but once they try to navigate to another page they are prompted to input the password again and then the process begins again.

UI to exclude a page from password protection

Latest version?

Hi, thanks for your plugin – it's very useful!
I'd like to make a change – altering the login URL path to /login/ from a query string parameter – but I'm not sure what the most recent version I should use.

The version active on the site I'm working with is 1.9 from https://wordpress.org/plugins/password-protected/ but this GitHub repo has 1.8 as the latest tagged version. Would you mind updating either the repo or the documentation and tag? thanks

Can't save a blank password?

http://wordpress.org/support/topic/plugin-password-protected-ability-to-store-unhashed-password?replies=9#post-3320711

408 Request Timed Out

I'm using WP 4.0 with the twentyfourteen theme. No other plugins at the moment. When I try to login using Password Protect, I get:
408 Request Timed Out
Your browser didn't send a complete request in time.

I can log in as admin through .../wp-admin without issue.

Password-Protect Problem

Hi,

I installed your password protection plug for Wordpress. It seems to work fine in IE and Chrome, but in Firefox (v. 10.0.2) I get a page that says 401 Authorization Required - Invalid login credentials, but I'm not getting the login screen before it does that.

Any ideas?

Thanks,
ginger

Add a "Remember my Password" option

Solution for WP Engine issues

Password Protected will not work with WP Engine due to their page caching.

Suggestion is to implement a Javascript redirection fallback and display a message to users in admin. Also in the readme file.

http://wordpress.org/support/topic/plugin-not-working-with-wpenging-cache

Add option to just redirect to home page

https://wordpress.org/support/topic/how-to-hide-enormous-url-when-logging-in?replies=3#post-6069803

Allow IP Addresses Range

Allow IP Addresses is a great feature but what could be better is an Allow IP Range. Something similar to this: http://www.csgnetwork.com/ipinfocalc.html

https://wordpress.org/support/topic/allow-ip-addresses-range

If anyone fancies working on this, please submit a pull request.

Allow logout to expire at end of session

See this comment:
http://www.benhuson.co.uk/wordpress-plugins/password-protected/#comment-211450

There are currently hooks to set after how long to expire but doesn;t allow for end of session.

Maybe this should be default behaviour?

Problem with Better WP Security

I love this plugin, it looks very nice using the default WordPress login page. Though I did find one problem. I have Better WP security installed with hide mode enabled. This hides and protects my wp-admin and wp-login.php files and directories. If your not logged into WordPress when trying to access /wp-admin you will get a 404 error.

This has been causing problems because the password protected plugin is trying to use two style sheets that's located in wp-admin. wp-admin/css/wp-admin.min.css?ver=3.5.1 and colors-fresh.min.css?ver=3.5.1.

Here is what it looks like with out the style sheets loaded
https://f.cloud.github.com/assets/3825621/630041/de3c587c-d187-11e2-801f-8347bb718d53.png
.

Use wp_hash_password() ?

Changing login icon

Hello, currently the Wordpress icon is visible when requiring users to log in. Can I customize this logo? Say to something like this... http://www.cellularsalesevents.com/wp-content/uploads/2014/10/cs_logo.png . How would I go about doing this?

Integrate With BM Custom Login

Hi

Please can you integrate it with:
https://wordpress.org/plugins/bm-custom-login/

It's more updated and maintained than the other login plugins you recommend.

Regards
Alex

Possible to redirect to custom URL when logging out

http://www.benhuson.co.uk/wordpress-plugins/password-protected/#comment-284455

Login via password in URL

http://wordpress.org/support/topic/include-password-in-url?replies=2#post-5410578

Add ability to allow/reject based on user agent?

So that you could allow Google Bot for example.

See https://wordpress.org/support/topic/can-google-see-a-password-protected-site?replies=2#post-7619326

Password protect plugin stops rss feeds from working after disabling

Password protect plugin stops rss feeds from working after disabling. Fix: uninstall
Props @Zaki_Usman

Problems when leaving comments

It works in that it asks for a password, but when someone selects ‘leave comment’ to one of my posts, it asks for a password again.

you then reenter the password, and then the original page is displayed. So user selects ‘leave comment’ again, and it then asks for the password… and the cycle repeats.

http://www.benhuson.co.uk/wordpress-plugins/password-protected/#comment-189553

Not working in Wordpress 4.2 (version 2.0)

I'm sure you're aware of it but Password Protected is not working with the latest Wordpress.

WP Super Cache, login behavior can be erratic

When using with WP Super Cache, login behavior can be erratic if password is reset in WP’s Privacy area.
More here: http://www.benhuson.co.uk/wordpress-plugins/password-protected/#comment-209353

cant deactivate and delete plugin

Hi,

This plugin doesnt work for me. I just want to password protect the homepage, not every single page.

Ive tried deactivating and deleting the plugin but the plugin is still active! How can I delete this please?

Thanks
Damien

Add hint?

Is it possible to add a hint to the login-page? Like if some people only once in a while will visit the page, it would be nice to show a hint