robertoiacono

<p><strong>RIACO Content Protector</strong> allows you to protect <em>any part</em> of your WordPress content using a shortcode.<br />
Unlike the built-in post password protection, this plugin protects only what you wrap, <em>not the whole post</em>.</p>
<p>Perfect for:</p>
<ul>
<li>Protecting premium blocks of content  </li>
<li>Protecting guides, downloads, links, or sensitive sections   </li>
<li>Paywall-style snippets</li>
</ul>
<h3>Features</h3>
<ul>
<li>Protect <strong>only specific content</strong> inside posts/pages</li>
<li>Uses a minimal shortcode:<br />
  [riaco_content_protector] Hidden text here [/riaco_content_protector]</li>
<li><strong>Global password</strong> stored in plain text, like WordPress page passwords.</li>
<li>AJAX-based form — no page reload</li>
<li>Unlocks <strong>all protected sections</strong> on the site after correct password</li>
<li>Optional cookie persistence (remember unlocked content for a configurable number of days)</li>
<li>Secure implementation using nonces, hashed tokens, and transients</li>
<li>Developer-friendly: filters, actions, and JS custom events at every key point in the unlock flow</li>
</ul>
<p><strong>Important:</strong></p>
<ul>
<li>The global password is stored in plain text, just like WordPress page passwords. It can be read by user with ‘manage_options’ ability.</li>
<li>If the global password or “Remember Unlocked” duration is changed in settings, all existing unlock cookies are invalidated. Users will need to re-enter the new password to access protected content.</li>
</ul>
<h3>How It Works</h3>
<p>Wrap content you want to protect:</p>
<pre><code>[riaco_content_protector]
This text will be hidden until the visitor enters the password.
[/riaco_content_protector]
</code></pre>
<p>Set the global password under:</p>
<p><strong>Settings > Content Protector</strong></p>
<p>Visitors will see a modern, styled form.<br />
After entering the correct password:</p>
<ul>
<li>The content unlocks immediately  </li>
<li>All other protected areas unlock automatically  </li>
<li>An optional cookie can keep everything unlocked for a chosen number of days  </li>
</ul>
<h3>Security</h3>
<ul>
<li>Nonces on every request  </li>
<li>Secure HMAC token for cookie authentication  </li>
<li>Sanitized shortcode attributes  </li>
<li>Escaped output  </li>
<li>No sensitive data stored in cookies  </li>
<li>Global password stored in plain text, like WordPress page passwords. </li>
</ul>
<h3>Cookie</h3>
<p>The default cookie name is <code>riaco_cp_unlocked_global</code>. The scope suffix <code>global</code> can be changed via the <code>riaco_cp_cookie_scope</code> filter, which also changes the cookie name accordingly.</p>
<h3>Style</h3>
<p>You can style the content protector box.</p>
<p>It has this class: <code>.riaco-cp--container</code>, so you can add in your <code>style.css</code>:</p>
<pre><code>.riaco-cp--container {
    background: #f8f9fa;
    padding: 20px;
    border: 1px solid #ddd;
    border-radius: 6px;
}
</code></pre>
<p>You can replace button classes using:</p>
<pre><code>add_filter( 'riaco_cp_button_classes', function( $classes ) {
    return 'button my-custom-button-class';
});
</code></pre>
<p>Or you can remove button classes:</p>
<pre><code>add_filter( 'riaco_cp_button_classes', function( $classes ) {
    return str_replace( 'wp-element-button', '', $classes );
});
</code></pre>
<h3>For Developers</h3>
<p>The plugin exposes actions and filters at every key point so you can extend or customise behaviour without modifying plugin files.</p>
<p><strong>Filters</strong></p>
<pre><code>riaco_cp_default_options — modify the option defaults written on first activation.


add_filter( 'riaco_cp_default_options', function( $defaults ) {
    $defaults['remember_days'] = 30;
    return $defaults;
});


riaco_cp_instance_id — override the computed instance ID for a protected block.


add_filter( 'riaco_cp_instance_id', function( $id, $atts, $content ) {
    return ! empty( $atts['id'] ) ? 'my_prefix_' . $atts['id'] : $id;
}, 10, 3 );


riaco_cp_transient_expiry — change how long protected content is cached (default: `DAY_IN_SECONDS`).


add_filter( 'riaco_cp_transient_expiry', function( $seconds, $instance_id ) {
    return HOUR_IN_SECONDS * 6;
}, 10, 2 );


riaco_cp_lock_message — customise the message shown above the password field.


add_filter( 'riaco_cp_lock_message', function( $message, $instance_id ) {
    return __( 'Members only. Enter your access code:', 'my-theme' );
}, 10, 2 );


riaco_cp_unlocked_content — wrap or replace the HTML around unlocked content.


add_filter( 'riaco_cp_unlocked_content', function( $html, $content, $instance_id ) {
    return '<div class="my-unlocked-wrapper">' . $content . '</div>';
}, 10, 3 );


riaco_cp_cookie_args — modify the options passed to `setcookie()`.


add_filter( 'riaco_cp_cookie_args', function( $args, $cookie_name ) {
    $args['samesite'] = 'Strict';
    return $args;
}, 10, 2 );


riaco_cp_max_attempts — change the brute-force rate-limit threshold (default: 5).


add_filter( 'riaco_cp_max_attempts', function( $max ) {
    return 10;
});


riaco_cp_rate_limit_window — change the rate-limit window in seconds (default: 15 minutes).


add_filter( 'riaco_cp_rate_limit_window', function( $seconds ) {
    return 5 * MINUTE_IN_SECONDS;
});


riaco_cp_content_access — override the cookie check before protected content is rendered. Return `null` to use the default cookie check, `true` to force-grant access, or `false` to force the lock form.


add_filter( 'riaco_cp_content_access', function( $access, $instance_id, $atts ) {
    // Grant access to logged-in users automatically.
    if ( is_user_logged_in() ) {
        return true;
    }
    return null; // Fall through to cookie check for guests.
}, 10, 3 );


riaco_cp_locked_html — replace or wrap the entire locked form HTML.


add_filter( 'riaco_cp_locked_html', function( $html, $instance_id, $atts ) {
    return '<div class="my-paywall">Subscribe to see this content.</div>';
}, 10, 3 );


riaco_cp_validate_password — override password validation. Return `null` to use the default `hash_equals` check, `true` to grant access, or `false` to deny. When non-null, the global password is not consulted.


add_filter( 'riaco_cp_validate_password', function( $result, $user_pass, $instance_id ) {
    // Accept a secondary password for a specific block.
    if ( $instance_id === 'riaco_cp_vip' && $user_pass === 'vip-secret' ) {
        return true;
    }
    return null; // Defer to global password check.
}, 10, 3 );


riaco_cp_rate_limit_bypass — bypass the brute-force counter for trusted IP addresses.


add_filter( 'riaco_cp_rate_limit_bypass', function( $bypass, $ip_address ) {
    $trusted = array( '127.0.0.1', '192.168.1.100' );
    return in_array( $ip_address, $trusted, true );
}, 10, 2 );


riaco_cp_cookie_scope — change the cookie scope suffix (default: `'global'`). The cookie name becomes `riaco_cp_unlocked_{scope}`. Use this to implement per-post or per-instance independent lock states.


add_filter( 'riaco_cp_cookie_scope', function( $scope, $instance_id ) {
    // Use a per-post cookie so each post unlocks independently.
    return 'post_' . get_the_ID();
}, 10, 2 );


riaco_cp_ajax_response — inject additional fields into the JSON success response sent after unlock.


add_filter( 'riaco_cp_ajax_response', function( $data, $instance_id ) {
    $data['redirect'] = home_url( '/members/' );
    return $data;
}, 10, 2 );


riaco_cp_js_data — add extra data to the `RIACO_CP_Ajax` JavaScript object.


add_filter( 'riaco_cp_js_data', function( $data ) {
    $data['my_feature_enabled'] = true;
    return $data;
});
</code></pre>
<p><strong>Actions</strong></p>
<pre><code>riaco_cp_loaded — fires after the plugin initialises; receives the `Plugin` instance.


add_action( 'riaco_cp_loaded', function( $plugin ) {
    // $plugin->settings, $plugin->shortcode, etc. are available here.
});


riaco_cp_form_fields — inject extra hidden inputs or markup inside the password form.


add_action( 'riaco_cp_form_fields', function( $instance_id ) {
    echo '<input type="hidden" name="my_field" value="' . esc_attr( $instance_id ) . '">';
});


riaco_cp_password_correct — fires when a visitor enters the correct password.


add_action( 'riaco_cp_password_correct', function( $instance_id ) {
    // Log unlock event, fire analytics, etc.
});


riaco_cp_password_incorrect — fires on a failed attempt; `$attempts` is the running total for this IP.


add_action( 'riaco_cp_password_incorrect', function( $instance_id, $attempts ) {
    if ( $attempts >= 3 ) {
        // Send alert, block IP in your firewall, etc.
    }
}, 10, 2 );


riaco_cp_cookie_set — fires after the unlock cookie is written.


add_action( 'riaco_cp_cookie_set', function( $cookie_name, $expire ) {
    // Record unlock timestamp, sync to a log, etc.
}, 10, 2 );


riaco_cp_settings_page_after — fires after the free plugin's settings form. Use it to render your own `<form>` block with additional settings fields below the existing form.


add_action( 'riaco_cp_settings_page_after', function() {
    // Render a separate settings form here.
});
</code></pre>
<p><strong>JavaScript Custom Events</strong></p>
<p>The plugin triggers jQuery custom events on the <code>.riaco-cp--container</code> element at key moments. Listen from any JavaScript file that loads after the plugin’s script.</p>
<pre><code>riaco_cp:before_submit — fires just before the AJAX password call. Call `e.preventDefault()` to cancel the submission (the UI is restored automatically).


$(document).on('riaco_cp:before_submit', '.riaco-cp--container', function(e, instanceId, password) {
    // e.preventDefault(); // uncomment to cancel submission
});


riaco_cp:unlock_success — fires after a successful AJAX response, before the container is replaced with unlocked content.


$(document).on('riaco_cp:unlock_success', '.riaco-cp--container', function(e, instanceId, responseData) {
    console.log('Unlocked:', instanceId, responseData);
});


riaco_cp:unlock_error — fires on wrong password, rate-limit hit, or network/server failure.


$(document).on('riaco_cp:unlock_error', '.riaco-cp--container', function(e, instanceId, errorMessage) {
    console.warn('Unlock failed for', instanceId, errorMessage);
});
</code></pre>
<h3>License</h3>
<p>This plugin is licensed under GPLv2 or later.</p>


RIACO Content Protector

Protect any portion of your WordPress content using a simple shortcode. Includes global password, AJAX unlock, and site-wide instant access.

RIACO Content Protector vs Kadence Security – Password, Two Factor Authentication, and Brute Force Protection