Reread your question and revised the solution as well. It is a Page template now and should be set to the page that needs its content protected. It relies on a “login” post that has the html from.
<?php
/*
Template Name: Protected Page
*/
// Standard HTML of Theme
global $post;
// check if authentication has been made
if( verifyAuthentication($_POST['authCode']) ) {
// display protected content
the_content();
}
else {
// fetch the login form html from "login" post. Or you can read from a file or some admin settings of your plugin.
$login_post = get_post( url_to_postid("login") );
// display the html form
echo apply_filters('the_content',$login_post->post_content );
}
// Standard HTML of Theme
Post parameter authCode is supposed to be present and valid when login has been successfully authenticated.