The post password cookie is set with:
setcookie(
'wp-postpass_' . COOKIEHASH,
$hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ),
$expire,
COOKIEPATH,
COOKIE_DOMAIN,
$secure
);
in the wp-login.php
file.
We can then use the clear_auth_cookie
hook, in the wp_clear_auth_cookie()
function, to clear it on logout:
/**
* Clear the Post Password Cookie on logout.
*
* @link http://wordpress.stackexchange.com/a/198890/26350
*/
add_action( 'clear_auth_cookie', function()
{
setcookie(
'wp-postpass_' . COOKIEHASH,
'',
time() - YEAR_IN_SECONDS,
COOKIEPATH,
COOKIE_DOMAIN
);
});
Related Posts:
- How to delete Passwrd Protected posts cookies when a user logged out from the site
- Security error WP 4.0 + WP phpBB Bridge [closed]
- Preventing BFA in WordPress without using a plugin
- Specific way to allow WordPress users to view their current password? And edit it?
- My WP site and password was hacked, what to do? [closed]
- How to resolve these findings from security audit
- Stop the user if login from the cookies
- What security concerns should I have when setting FS_METHOD to “direct” in wp-config?
- What Are Security Best Practices for WordPress Plugins and Themes? [closed]
- Are WordPress Plugins essential?
- What are the common security flaws I need to look for? [closed]
- Why “Contact Form 7” doesn’t update PHPmailer library?
- Secure WordPress paid plugin
- Disable saving comment details (name, e-mail) in cookie?
- How to make media upload private? [duplicate]
- Does WordPress contain “default” anti-SQL injection code that responds with a 404 error?
- What does a security risk in a plugin look like?
- WordPress Capabilities: edit_user vs edit_users
- How to check plugins for malicious code?
- How to properly secure my WordPress installation?
- Add new password rule to Ultimate Member register form
- login to wordpress with Get variables instead of Post
- Why am I sometimes getting a 404 error when I try to update a page with Elementor?
- Should I use RIPS tool to test my themes and plugins?
- Is it possible to block subscriber users to changing its password?
- Problem protecting a page with a password
- Why users disable the WordPress update?
- How many security plugins are too many? [closed]
- Will WordPress username displayed somewhere in the site?
- Upgrading WordPress 4.0 asks for FTP password
- Is revealing just the AUTH_KEY a security issue?
- How Restrict access to admin dashboard by specific static ip?
- How to create a word press user with hashedpassword
- Protecting against malicious code in WordPress plugin updates
- Is there any good tutorial to write custom login, registration and password recovery forms? [closed]
- Why Better WP security plugin returns 418 I’m a Teapot “error”?
- Popup Cookie WordPress select language and section (Elementor)
- How to limit WordPress pages during updates?
- rms_unique_wp_mu_pl_fl_nm.php
- Security issues with WP sites
- Security checking in meta_box save is reluctant?
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- Why is my staging subdomain not sending wordpress_logged_in cookies?
- The safest way to automate WordPress backups
- wp_create_nonce function doesn’t work inside a plugin?
- Does WordPress validate inputs to all functions? (such as get_user_meta and insert_user_meta)
- Headers Content-Security-Policy CSP Major Issue
- Nonce failing on form submission
- Login cookies set as wrong domain
- Malware installation during plugin update?
- add_action in a custom plugin
- I should enable automatic updates?
- Can some vulnerabilities in plugins be exploited even when the plugin is inactive?
- Prevent direct access to WordPress plugin assets?
- Completely disabling password reset/recovery
- Too many login attempts
- Is there any pre-existing plugin to track and block IPs with suspicious activity on my site?
- Website show Google Ads when we have no Google Ads linked to our website
- Custom API plugin to execute 3rd party API to retrieve data
- How to deal with Slow HTTP POST (slowloris) vulnerability
- Running multiple security plugins
- how do I secure my WP website from hackers? [closed]
- Chrome Dev Tools console says every page in my blog has link to http://maps.google.com [closed]
- Webservice credential storage [duplicate]
- Regarding plugin security
- Is this plugin safe to run?
- Is the Block Bad Queries Plugin Still Relevant?
- Hide plugins and theme from public
- Codeless random token generation to pass into multiple tracking links in a single page load
- Security of a WordPress Plugin
- How can I disable new plugin and theme install, but allow updates?
- Create Woocommerce account password post-checkout on thank you page
- Validating ajax search
- Cookie value changes back to previous value after changing
- Automatic chage password of pages after some time
- prevent anonymous access to WordPress site (non-admin site)
- wp_set_password() does not work!
- Bing/msn bots is heavily requesting random of my website
- Password Protect wp-content?
- Securing a plugin pop-up window
- Create password protected page, no registration
- WordPress delete cookie
- Why does WordPress use cookies for /wp-admin and /wp-content/plugins for non-admin users [duplicate]
- Implementation to count page visits of unique visitors based on a cookie
- Cookie set in a plugin visible in admin but not on front
- How can I save cookies to members
- How can i see/log all requests coming from a registration form (not from the UI)?
- Write mysql credentials in plugin
- Site is continuously accessing by several IPs
- using .htaccess only for wordpress security no plugins
- SWF in wordpress post
- set cookies for my whole site is not working
- Unwanted Links and Spam WordPress Pages and Posts
- Alter the reset password link
- Password Protected Directory Link Shows Maintenance Mode Page
- File permissions for wp-minify plugin
- What is the recommended way to be notified of security updates to my plugins? [closed]
- Undefined constant error in pluggable.php
- WordPress User Registration/ Sign Up -> Able to take Paid Certification Courses & keep track of Completed Certificates
- Block Root REST API Route using custom &/or iThemes