robertoiacono

<p><strong>RIACO Content Protector</strong> allows you to protect <em>any part</em> of your WordPress content using a shortcode.<br />
Unlike the built-in post password protection, this plugin protects only what you wrap, <em>not the whole post</em>.</p>
<p>Perfect for:</p>
<ul>
<li>Protecting premium blocks of content  </li>
<li>Protecting guides, downloads, links, or sensitive sections   </li>
<li>Paywall-style snippets</li>
</ul>
<h3>Features</h3>
<ul>
<li>Protect <strong>only specific content</strong> inside posts/pages</li>
<li>Uses a minimal shortcode:<br />
  [riaco_content_protector] Hidden text here [/riaco_content_protector]</li>
<li><strong>Global password</strong> stored in plain text, like WordPress page passwords.</li>
<li>AJAX-based form — no page reload</li>
<li>Unlocks <strong>all protected sections</strong> on the site after correct password</li>
<li>Optional cookie persistence (remember unlocked content for a configurable number of days)</li>
<li>Secure implementation using nonces, hashed tokens, and transients</li>
<li>Developer-friendly: filters, actions, and JS custom events at every key point in the unlock flow</li>
</ul>
<p><strong>Important:</strong></p>
<ul>
<li>The global password is stored in plain text, just like WordPress page passwords. It can be read by user with ‘manage_options’ ability.</li>
<li>If the global password or “Remember Unlocked” duration is changed in settings, all existing unlock cookies are invalidated. Users will need to re-enter the new password to access protected content.</li>
</ul>
<h3>How It Works</h3>
<p>Wrap content you want to protect:</p>
<pre><code>[riaco_content_protector]
This text will be hidden until the visitor enters the password.
[/riaco_content_protector]
</code></pre>
<p>Set the global password under:</p>
<p><strong>Settings > Content Protector</strong></p>
<p>Visitors will see a modern, styled form.<br />
After entering the correct password:</p>
<ul>
<li>The content unlocks immediately  </li>
<li>All other protected areas unlock automatically  </li>
<li>An optional cookie can keep everything unlocked for a chosen number of days  </li>
</ul>
<h3>Security</h3>
<ul>
<li>Nonces on every request  </li>
<li>Secure HMAC token for cookie authentication  </li>
<li>Sanitized shortcode attributes  </li>
<li>Escaped output  </li>
<li>No sensitive data stored in cookies  </li>
<li>Global password stored in plain text, like WordPress page passwords. </li>
</ul>
<h3>Cookie</h3>
<p>The default cookie name is <code>riaco_cp_unlocked_global</code>. The scope suffix <code>global</code> can be changed via the <code>riaco_cp_cookie_scope</code> filter, which also changes the cookie name accordingly.</p>
<h3>Style</h3>
<p>You can style the content protector box.</p>
<p>It has this class: <code>.riaco-cp--container</code>, so you can add in your <code>style.css</code>:</p>
<pre><code>.riaco-cp--container {
    background: #f8f9fa;
    padding: 20px;
    border: 1px solid #ddd;
    border-radius: 6px;
}
</code></pre>
<p>You can replace button classes using:</p>
<pre><code>add_filter( 'riaco_cp_button_classes', function( $classes ) {
    return 'button my-custom-button-class';
});
</code></pre>
<p>Or you can remove button classes:</p>
<pre><code>add_filter( 'riaco_cp_button_classes', function( $classes ) {
    return str_replace( 'wp-element-button', '', $classes );
});
</code></pre>
<h3>For Developers</h3>
<p>The plugin exposes actions and filters at every key point so you can extend or customise behaviour without modifying plugin files.</p>
<p><strong>Filters</strong></p>
<pre><code>riaco_cp_default_options — modify the option defaults written on first activation.


add_filter( 'riaco_cp_default_options', function( $defaults ) {
    $defaults['remember_days'] = 30;
    return $defaults;
});


riaco_cp_instance_id — override the computed instance ID for a protected block.


add_filter( 'riaco_cp_instance_id', function( $id, $atts, $content ) {
    return ! empty( $atts['id'] ) ? 'my_prefix_' . $atts['id'] : $id;
}, 10, 3 );


riaco_cp_transient_expiry — change how long protected content is cached (default: `DAY_IN_SECONDS`).


add_filter( 'riaco_cp_transient_expiry', function( $seconds, $instance_id ) {
    return HOUR_IN_SECONDS * 6;
}, 10, 2 );


riaco_cp_lock_message — customise the message shown above the password field.


add_filter( 'riaco_cp_lock_message', function( $message, $instance_id ) {
    return __( 'Members only. Enter your access code:', 'my-theme' );
}, 10, 2 );


riaco_cp_unlocked_content — wrap or replace the HTML around unlocked content.


add_filter( 'riaco_cp_unlocked_content', function( $html, $content, $instance_id ) {
    return '<div class="my-unlocked-wrapper">' . $content . '</div>';
}, 10, 3 );


riaco_cp_cookie_args — modify the options passed to `setcookie()`.


add_filter( 'riaco_cp_cookie_args', function( $args, $cookie_name ) {
    $args['samesite'] = 'Strict';
    return $args;
}, 10, 2 );


riaco_cp_max_attempts — change the brute-force rate-limit threshold (default: 5).


add_filter( 'riaco_cp_max_attempts', function( $max ) {
    return 10;
});


riaco_cp_rate_limit_window — change the rate-limit window in seconds (default: 15 minutes).


add_filter( 'riaco_cp_rate_limit_window', function( $seconds ) {
    return 5 * MINUTE_IN_SECONDS;
});


riaco_cp_content_access — override the cookie check before protected content is rendered. Return `null` to use the default cookie check, `true` to force-grant access, or `false` to force the lock form.


add_filter( 'riaco_cp_content_access', function( $access, $instance_id, $atts ) {
    // Grant access to logged-in users automatically.
    if ( is_user_logged_in() ) {
        return true;
    }
    return null; // Fall through to cookie check for guests.
}, 10, 3 );


riaco_cp_locked_html — replace or wrap the entire locked form HTML.


add_filter( 'riaco_cp_locked_html', function( $html, $instance_id, $atts ) {
    return '<div class="my-paywall">Subscribe to see this content.</div>';
}, 10, 3 );


riaco_cp_validate_password — override password validation. Return `null` to use the default `hash_equals` check, `true` to grant access, or `false` to deny. When non-null, the global password is not consulted.


add_filter( 'riaco_cp_validate_password', function( $result, $user_pass, $instance_id ) {
    // Accept a secondary password for a specific block.
    if ( $instance_id === 'riaco_cp_vip' && $user_pass === 'vip-secret' ) {
        return true;
    }
    return null; // Defer to global password check.
}, 10, 3 );


riaco_cp_rate_limit_bypass — bypass the brute-force counter for trusted IP addresses.


add_filter( 'riaco_cp_rate_limit_bypass', function( $bypass, $ip_address ) {
    $trusted = array( '127.0.0.1', '192.168.1.100' );
    return in_array( $ip_address, $trusted, true );
}, 10, 2 );


riaco_cp_cookie_scope — change the cookie scope suffix (default: `'global'`). The cookie name becomes `riaco_cp_unlocked_{scope}`. Use this to implement per-post or per-instance independent lock states.


add_filter( 'riaco_cp_cookie_scope', function( $scope, $instance_id ) {
    // Use a per-post cookie so each post unlocks independently.
    return 'post_' . get_the_ID();
}, 10, 2 );


riaco_cp_ajax_response — inject additional fields into the JSON success response sent after unlock.


add_filter( 'riaco_cp_ajax_response', function( $data, $instance_id ) {
    $data['redirect'] = home_url( '/members/' );
    return $data;
}, 10, 2 );


riaco_cp_js_data — add extra data to the `RIACO_CP_Ajax` JavaScript object.


add_filter( 'riaco_cp_js_data', function( $data ) {
    $data['my_feature_enabled'] = true;
    return $data;
});
</code></pre>
<p><strong>Actions</strong></p>
<pre><code>riaco_cp_loaded — fires after the plugin initialises; receives the `Plugin` instance.


add_action( 'riaco_cp_loaded', function( $plugin ) {
    // $plugin->settings, $plugin->shortcode, etc. are available here.
});


riaco_cp_form_fields — inject extra hidden inputs or markup inside the password form.


add_action( 'riaco_cp_form_fields', function( $instance_id ) {
    echo '<input type="hidden" name="my_field" value="' . esc_attr( $instance_id ) . '">';
});


riaco_cp_password_correct — fires when a visitor enters the correct password.


add_action( 'riaco_cp_password_correct', function( $instance_id ) {
    // Log unlock event, fire analytics, etc.
});


riaco_cp_password_incorrect — fires on a failed attempt; `$attempts` is the running total for this IP.


add_action( 'riaco_cp_password_incorrect', function( $instance_id, $attempts ) {
    if ( $attempts >= 3 ) {
        // Send alert, block IP in your firewall, etc.
    }
}, 10, 2 );


riaco_cp_cookie_set — fires after the unlock cookie is written.


add_action( 'riaco_cp_cookie_set', function( $cookie_name, $expire ) {
    // Record unlock timestamp, sync to a log, etc.
}, 10, 2 );


riaco_cp_settings_page_after — fires after the free plugin's settings form. Use it to render your own `<form>` block with additional settings fields below the existing form.


add_action( 'riaco_cp_settings_page_after', function() {
    // Render a separate settings form here.
});
</code></pre>
<p><strong>JavaScript Custom Events</strong></p>
<p>The plugin triggers jQuery custom events on the <code>.riaco-cp--container</code> element at key moments. Listen from any JavaScript file that loads after the plugin’s script.</p>
<pre><code>riaco_cp:before_submit — fires just before the AJAX password call. Call `e.preventDefault()` to cancel the submission (the UI is restored automatically).


$(document).on('riaco_cp:before_submit', '.riaco-cp--container', function(e, instanceId, password) {
    // e.preventDefault(); // uncomment to cancel submission
});


riaco_cp:unlock_success — fires after a successful AJAX response, before the container is replaced with unlocked content.


$(document).on('riaco_cp:unlock_success', '.riaco-cp--container', function(e, instanceId, responseData) {
    console.log('Unlocked:', instanceId, responseData);
});


riaco_cp:unlock_error — fires on wrong password, rate-limit hit, or network/server failure.


$(document).on('riaco_cp:unlock_error', '.riaco-cp--container', function(e, instanceId, errorMessage) {
    console.warn('Unlock failed for', instanceId, errorMessage);
});
</code></pre>
<h3>License</h3>
<p>This plugin is licensed under GPLv2 or later.</p>


RIACO Content Protector

Protect any portion of your WordPress content using a simple shortcode. Includes global password, AJAX unlock, and site-wide instant access.

Maruti Mohanty

<p>You can see more, on how to use the plugin here in this blog <a href="http://www.sourcexpress.com/wp-double-protection/" rel="nofollow ugc">WP Double Protection</a></p>
<h4>Plugin’s Features:</h4>
<ul>
<li>Allow user to use two different password for the website and thus makes the website extra secure.</li>
<li>Once the plugin is activated and until the user has not set his second password in the user profile, the second password will be same as the first password.</li>
<li>Once the second password is set from the user profile, the user would now need to enter the corresponding passwords while login.</li>
<li>To reset the second password the user has to follow the default lost password link and it will reset the second password to the newly chosen main password and then the user would have to again set a different second password from the user profile</li>
</ul>
<p>You can also help me make the plugin better by contributing to the plugin in <a href="https://github.com/marutim/wp-double-protection" rel="nofollow ugc">Github</a></p>


WP Double Protection

This plugin allows a second password option and thus making your website doubly protected.

RIACO Content Protector vs WP Double Protection