robertoiacono

<p><strong>RIACO Content Protector</strong> allows you to protect <em>any part</em> of your WordPress content using a shortcode.<br />
Unlike the built-in post password protection, this plugin protects only what you wrap, <em>not the whole post</em>.</p>
<p>Perfect for:</p>
<ul>
<li>Protecting premium blocks of content  </li>
<li>Protecting guides, downloads, links, or sensitive sections   </li>
<li>Paywall-style snippets</li>
</ul>
<h3>Features</h3>
<ul>
<li>Protect <strong>only specific content</strong> inside posts/pages</li>
<li>Uses a minimal shortcode:<br />
  [riaco_content_protector] Hidden text here [/riaco_content_protector]</li>
<li><strong>Global password</strong> stored in plain text, like WordPress page passwords.</li>
<li>AJAX-based form — no page reload</li>
<li>Unlocks <strong>all protected sections</strong> on the site after correct password</li>
<li>Optional cookie persistence (remember unlocked content for a configurable number of days)</li>
<li>Secure implementation using nonces, hashed tokens, and transients</li>
<li>Developer-friendly: filters, actions, and JS custom events at every key point in the unlock flow</li>
</ul>
<p><strong>Important:</strong></p>
<ul>
<li>The global password is stored in plain text, just like WordPress page passwords. It can be read by user with ‘manage_options’ ability.</li>
<li>If the global password or “Remember Unlocked” duration is changed in settings, all existing unlock cookies are invalidated. Users will need to re-enter the new password to access protected content.</li>
</ul>
<h3>How It Works</h3>
<p>Wrap content you want to protect:</p>
<pre><code>[riaco_content_protector]
This text will be hidden until the visitor enters the password.
[/riaco_content_protector]
</code></pre>
<p>Set the global password under:</p>
<p><strong>Settings > Content Protector</strong></p>
<p>Visitors will see a modern, styled form.<br />
After entering the correct password:</p>
<ul>
<li>The content unlocks immediately  </li>
<li>All other protected areas unlock automatically  </li>
<li>An optional cookie can keep everything unlocked for a chosen number of days  </li>
</ul>
<h3>Security</h3>
<ul>
<li>Nonces on every request  </li>
<li>Secure HMAC token for cookie authentication  </li>
<li>Sanitized shortcode attributes  </li>
<li>Escaped output  </li>
<li>No sensitive data stored in cookies  </li>
<li>Global password stored in plain text, like WordPress page passwords. </li>
</ul>
<h3>Cookie</h3>
<p>The default cookie name is <code>riaco_cp_unlocked_global</code>. The scope suffix <code>global</code> can be changed via the <code>riaco_cp_cookie_scope</code> filter, which also changes the cookie name accordingly.</p>
<h3>Style</h3>
<p>You can style the content protector box.</p>
<p>It has this class: <code>.riaco-cp--container</code>, so you can add in your <code>style.css</code>:</p>
<pre><code>.riaco-cp--container {
    background: #f8f9fa;
    padding: 20px;
    border: 1px solid #ddd;
    border-radius: 6px;
}
</code></pre>
<p>You can replace button classes using:</p>
<pre><code>add_filter( 'riaco_cp_button_classes', function( $classes ) {
    return 'button my-custom-button-class';
});
</code></pre>
<p>Or you can remove button classes:</p>
<pre><code>add_filter( 'riaco_cp_button_classes', function( $classes ) {
    return str_replace( 'wp-element-button', '', $classes );
});
</code></pre>
<h3>For Developers</h3>
<p>The plugin exposes actions and filters at every key point so you can extend or customise behaviour without modifying plugin files.</p>
<p><strong>Filters</strong></p>
<pre><code>riaco_cp_default_options — modify the option defaults written on first activation.


add_filter( 'riaco_cp_default_options', function( $defaults ) {
    $defaults['remember_days'] = 30;
    return $defaults;
});


riaco_cp_instance_id — override the computed instance ID for a protected block.


add_filter( 'riaco_cp_instance_id', function( $id, $atts, $content ) {
    return ! empty( $atts['id'] ) ? 'my_prefix_' . $atts['id'] : $id;
}, 10, 3 );


riaco_cp_transient_expiry — change how long protected content is cached (default: `DAY_IN_SECONDS`).


add_filter( 'riaco_cp_transient_expiry', function( $seconds, $instance_id ) {
    return HOUR_IN_SECONDS * 6;
}, 10, 2 );


riaco_cp_lock_message — customise the message shown above the password field.


add_filter( 'riaco_cp_lock_message', function( $message, $instance_id ) {
    return __( 'Members only. Enter your access code:', 'my-theme' );
}, 10, 2 );


riaco_cp_unlocked_content — wrap or replace the HTML around unlocked content.


add_filter( 'riaco_cp_unlocked_content', function( $html, $content, $instance_id ) {
    return '<div class="my-unlocked-wrapper">' . $content . '</div>';
}, 10, 3 );


riaco_cp_cookie_args — modify the options passed to `setcookie()`.


add_filter( 'riaco_cp_cookie_args', function( $args, $cookie_name ) {
    $args['samesite'] = 'Strict';
    return $args;
}, 10, 2 );


riaco_cp_max_attempts — change the brute-force rate-limit threshold (default: 5).


add_filter( 'riaco_cp_max_attempts', function( $max ) {
    return 10;
});


riaco_cp_rate_limit_window — change the rate-limit window in seconds (default: 15 minutes).


add_filter( 'riaco_cp_rate_limit_window', function( $seconds ) {
    return 5 * MINUTE_IN_SECONDS;
});


riaco_cp_content_access — override the cookie check before protected content is rendered. Return `null` to use the default cookie check, `true` to force-grant access, or `false` to force the lock form.


add_filter( 'riaco_cp_content_access', function( $access, $instance_id, $atts ) {
    // Grant access to logged-in users automatically.
    if ( is_user_logged_in() ) {
        return true;
    }
    return null; // Fall through to cookie check for guests.
}, 10, 3 );


riaco_cp_locked_html — replace or wrap the entire locked form HTML.


add_filter( 'riaco_cp_locked_html', function( $html, $instance_id, $atts ) {
    return '<div class="my-paywall">Subscribe to see this content.</div>';
}, 10, 3 );


riaco_cp_validate_password — override password validation. Return `null` to use the default `hash_equals` check, `true` to grant access, or `false` to deny. When non-null, the global password is not consulted.


add_filter( 'riaco_cp_validate_password', function( $result, $user_pass, $instance_id ) {
    // Accept a secondary password for a specific block.
    if ( $instance_id === 'riaco_cp_vip' && $user_pass === 'vip-secret' ) {
        return true;
    }
    return null; // Defer to global password check.
}, 10, 3 );


riaco_cp_rate_limit_bypass — bypass the brute-force counter for trusted IP addresses.


add_filter( 'riaco_cp_rate_limit_bypass', function( $bypass, $ip_address ) {
    $trusted = array( '127.0.0.1', '192.168.1.100' );
    return in_array( $ip_address, $trusted, true );
}, 10, 2 );


riaco_cp_cookie_scope — change the cookie scope suffix (default: `'global'`). The cookie name becomes `riaco_cp_unlocked_{scope}`. Use this to implement per-post or per-instance independent lock states.


add_filter( 'riaco_cp_cookie_scope', function( $scope, $instance_id ) {
    // Use a per-post cookie so each post unlocks independently.
    return 'post_' . get_the_ID();
}, 10, 2 );


riaco_cp_ajax_response — inject additional fields into the JSON success response sent after unlock.


add_filter( 'riaco_cp_ajax_response', function( $data, $instance_id ) {
    $data['redirect'] = home_url( '/members/' );
    return $data;
}, 10, 2 );


riaco_cp_js_data — add extra data to the `RIACO_CP_Ajax` JavaScript object.


add_filter( 'riaco_cp_js_data', function( $data ) {
    $data['my_feature_enabled'] = true;
    return $data;
});
</code></pre>
<p><strong>Actions</strong></p>
<pre><code>riaco_cp_loaded — fires after the plugin initialises; receives the `Plugin` instance.


add_action( 'riaco_cp_loaded', function( $plugin ) {
    // $plugin->settings, $plugin->shortcode, etc. are available here.
});


riaco_cp_form_fields — inject extra hidden inputs or markup inside the password form.


add_action( 'riaco_cp_form_fields', function( $instance_id ) {
    echo '<input type="hidden" name="my_field" value="' . esc_attr( $instance_id ) . '">';
});


riaco_cp_password_correct — fires when a visitor enters the correct password.


add_action( 'riaco_cp_password_correct', function( $instance_id ) {
    // Log unlock event, fire analytics, etc.
});


riaco_cp_password_incorrect — fires on a failed attempt; `$attempts` is the running total for this IP.


add_action( 'riaco_cp_password_incorrect', function( $instance_id, $attempts ) {
    if ( $attempts >= 3 ) {
        // Send alert, block IP in your firewall, etc.
    }
}, 10, 2 );


riaco_cp_cookie_set — fires after the unlock cookie is written.


add_action( 'riaco_cp_cookie_set', function( $cookie_name, $expire ) {
    // Record unlock timestamp, sync to a log, etc.
}, 10, 2 );


riaco_cp_settings_page_after — fires after the free plugin's settings form. Use it to render your own `<form>` block with additional settings fields below the existing form.


add_action( 'riaco_cp_settings_page_after', function() {
    // Render a separate settings form here.
});
</code></pre>
<p><strong>JavaScript Custom Events</strong></p>
<p>The plugin triggers jQuery custom events on the <code>.riaco-cp--container</code> element at key moments. Listen from any JavaScript file that loads after the plugin’s script.</p>
<pre><code>riaco_cp:before_submit — fires just before the AJAX password call. Call `e.preventDefault()` to cancel the submission (the UI is restored automatically).


$(document).on('riaco_cp:before_submit', '.riaco-cp--container', function(e, instanceId, password) {
    // e.preventDefault(); // uncomment to cancel submission
});


riaco_cp:unlock_success — fires after a successful AJAX response, before the container is replaced with unlocked content.


$(document).on('riaco_cp:unlock_success', '.riaco-cp--container', function(e, instanceId, responseData) {
    console.log('Unlocked:', instanceId, responseData);
});


riaco_cp:unlock_error — fires on wrong password, rate-limit hit, or network/server failure.


$(document).on('riaco_cp:unlock_error', '.riaco-cp--container', function(e, instanceId, errorMessage) {
    console.warn('Unlock failed for', instanceId, errorMessage);
});
</code></pre>
<h3>License</h3>
<p>This plugin is licensed under GPLv2 or later.</p>


RIACO Content Protector

Protect any portion of your WordPress content using a simple shortcode. Includes global password, AJAX unlock, and site-wide instant access.

NUCUTA

<p>‘Nucuta Password Protect’ is a security plugin which password protects wordpress websites. Requires PHP 5.6.30 or Above.</p>
<p>The plugin uses a custom password, and therefore it’s completely independant from default wordpress password uses to access to the admin area of the site. Users can be restricted to access the site either based on their user group or altogether.</p>
<p>The available user groups are “editor”, “author”, “contributor”, “subscriber”. if a particular group is excluded from protecting from the custom password, users belong to that group won’t be asked the password. Clicking on the log off button logs off from the entire website, meaning the user has to enter the password to access the site again. By default, all users (both guests and registered logged in users) are required to enter the password before accessing the site, but by configuring, logged in users can be excluded. The plugins blocks not only visitors, but also bots, spiders, and all kind of crawlers.</p>
<p>Custom message can be set for both logged in/non-logged in users, A separate login page is provided to login purpose. Password is salted before storing in the database, and therefore security is top notch. The full documentation, and how to use guide can be found at this location. <a href="https://nucuta.com/how-to-password-protect-wordpress-site/" rel="nofollow ugc">Documentation, Help and Tutorial</a></p>


Nucuta Password Protect

works even on php 7

Secure your wordpress site with a password. Useful for private blogs.

RIACO Content Protector vs Nucuta Password Protect