The post password cookie is set with:
setcookie(
'wp-postpass_' . COOKIEHASH,
$hasher->HashPassword( wp_unslash( $_POST['post_password'] ) ),
$expire,
COOKIEPATH,
COOKIE_DOMAIN,
$secure
);
in the wp-login.php
file.
We can then use the clear_auth_cookie
hook, in the wp_clear_auth_cookie()
function, to clear it on logout:
/**
* Clear the Post Password Cookie on logout.
*
* @link http://wordpress.stackexchange.com/a/198890/26350
*/
add_action( 'clear_auth_cookie', function()
{
setcookie(
'wp-postpass_' . COOKIEHASH,
'',
time() - YEAR_IN_SECONDS,
COOKIEPATH,
COOKIE_DOMAIN
);
});
Related Posts:
- How to delete Password Protected posts cookies when a user logged out from the site
- Security error WP 4.0 + WP phpBB Bridge [closed]
- Preventing BFA in WordPress without using a plugin
- Specific way to allow WordPress users to view their current password? And edit it?
- My WP site and password was hacked, what to do? [closed]
- How to resolve these findings from security audit
- Stop the user if login from the cookies
- What Are Security Best Practices for WordPress Plugins and Themes? [closed]
- Are WordPress Plugins essential?
- What are the common security flaws I need to look for? [closed]
- How Can I Securely Implement a Password-less Login Feature?
- Security and .htaccess
- Are there procedures to prevent malicious plugin updates?
- Secure WordPress paid plugin
- Keep one user logged for a year?
- Disable saving comment details (name, e-mail) in cookie?
- How to make media upload private? [duplicate]
- Does WordPress contain “default” anti-SQL injection code that responds with a 404 error?
- What does a security risk in a plugin look like?
- WordPress Capabilities: edit_user vs edit_users
- How to check plugins for malicious code?
- How to properly secure my WordPress installation?
- Where should my plugin POST to?
- Detecting $_GET parameters from any page + Cookie
- Why am I sometimes getting a 404 error when I try to update a page with Elementor?
- Is it possible to block subscriber users to changing its password?
- Why users disable the WordPress update?
- Will WordPress username displayed somewhere in the site?
- Is revealing just the AUTH_KEY a security issue?
- How to create a word press user with hashedpassword
- Is there any good tutorial to write custom login, registration and password recovery forms? [closed]
- Questions about brute force attacks on the admin username, coming from amazon IP addresses
- Why Better WP security plugin returns 418 I’m a Teapot “error”?
- How to expire all wordpress user passwords instantly?
- Security checking in meta_box save is reluctant?
- Should you escape hardcoded URLs?
- Do We Need to Validate, Sanitize, or Filter Simple Numerical Superglobals (Cookies and Post)?
- How To Clean The Malware Infected & Hacked WordPress Websites? [duplicate]
- Upgraded to latest version – 3.0.3 and Now I get a “sufficient permissions to access this page” error
- How to block plugin activations with no known user or coming from unknown IP address range?
- Check for security updates
- WordPress Keeps Logging Out – What Tests Can I Run to Solve This?
- User Session and Stored Cookies not get removed
- Where does the cookie mo_page_views_counter come from?
- Standard Fail2Ban vs. WP Fail2ban vs. WP Fail2Ban Redux
- Malicious File Upload [closed]
- Stop Plugin Enumeration [closed]
- Malware installation during plugin update?
- I should enable automatic updates?
- Security and Must Use Plugins
- Is it safe to use admin-ajax.php in the frontend?
- How to protect WordPress from security scanner [closed]
- Website show Google Ads when we have no Google Ads linked to our website
- Vulnerability Concern From the Plugin or From Not Updating the Plugin?
- Displaying content based on drop-down menu selection sitewide
- Chrome Dev Tools console says every page in my blog has link to http://maps.google.com [closed]
- Plugin: connect to external database without showing password
- Regarding plugin security
- How do I determine if the user who registered is not spam?
- 404 errors when updating options in admin dashboard
- Website Captcha Error: The reCAPTCHA wasn’t entered correctly
- Cookies set by a plugin in wordpress for tracking
- Codeless random token generation to pass into multiple tracking links in a single page load
- Can I disable xml-rpc by setting it to false?
- How can I disable new plugin and theme install, but allow updates?
- Help to Create a Simple Plugin to make a post
- Identify User Language, Redirect to the corresponding page and Save the chosen language as Cookie
- Validating ajax search
- Cookie value changes back to previous value after changing
- Display value of the GET parameter in a new URL page
- WordPress disable direct access of files in WordPress installation path
- Asking help regarding potential malware
- Login/password protected “client page”
- WordPress Admin login redirect to homepage
- Login issue in WordPress
- How to make a page both “private” and “password protected”
- Password Protect wp-content?
- Members-only page, but accessible via sharable link
- How can I store user preferences in WordPress and retreive them later?
- Create password protected page, no registration
- Cant visualize protected password portfolio elements
- Why does WordPress use cookies for /wp-admin and /wp-content/plugins for non-admin users [duplicate]
- Implementation to count page visits of unique visitors based on a cookie
- admin-ajax.php not working properly on subdomains
- Being hacked. Is there a list of WordPress security holes I can check against?
- wp_verify_nonce fails always
- Validating values using Settings API?
- set cookies for my whole site is not working
- Unwanted Links and Spam WordPress Pages and Posts
- How can I allow for the password protect feature to allow visitors to enter any number at all?
- Alter the reset password link
- Password Protected Directory Link Shows Maintenance Mode Page
- Problem with permissions in wp-content/plugins
- Is it possible to send user new password after they clicking on forgot password in word press
- File permissions for wp-minify plugin
- What is the recommended way to be notified of security updates to my plugins? [closed]
- ERROR: Cookies are blocked due to unexpected output – no access to FTP
- How to rename files during upload to a random string?
- WordPress User Registration/ Sign Up -> Able to take Paid Certification Courses & keep track of Completed Certificates
- Block Root REST API Route using custom &/or iThemes