=== Password Protected Site and Store ===
Contributors: codenix
Tags: protect categories protect store, protect page
Requires PHP: 7.4
Requires at least: 6.3
Tested up to: 7.0
Stable tag: 1.1.0
WC tested up to: 11.1.2
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

This is a great plugin for securing your WordPress Site. Easily set passwords to restrict access to the site and WooCommerce products.

== Description ==
[Documentation](https://codenix.io/docs/password-protected-site-and-store/) | [Support](https://wordpress.org/support/plugin/password-protected-site-and-store/)

Want to make your WordPress site password protected? Need to create a protected WooCommerce store for select users or clients only? Our Password Protected Site and Store plugin is the ultimate all-in-one solution to restrict access and fully customize the experience – without touching any code.

Whether you're building a staging site, client preview, private membership area, or exclusive product showcase – this plugin gives you complete control over who can access your WordPress site or WooCommerce store.

== Features ==

🔹 **Password Protect Anything:** Protect your entire site, specific pages, categories, custom post types, or WooCommerce store.
🔹 **WooCommerce Integration:** Password protect specific WooCommerce products, product categories, or the entire store.
🔹 **Multiple Passwords:** Create unique passwords for different sections, individual pages, or even products.
🔹 **Role-Based Bypass:** Automatically bypass password protection for specific user roles (e.g., Administrators, Editors).
🔹 **Google reCAPTCHA:** Prevent brute force attacks with integrated security checks on the login forms.
🔹 **Limit Login Attempts:** Lock out an IP address after a set number of failed password attempts, for a duration you choose. The password field is disabled while the lockout lasts.
🔹 **Feed & REST API Protection:** Keep protected content out of /feed/ and /wp-json/ as well as the page itself.
🔹 **IP Allowlist:** Let trusted addresses or CIDR ranges skip the password entirely.
🔹 **Session Control:** Decide how long a visitor stays unlocked, with an optional "Remember me" checkbox.
🔹 **Reorder & Duplicate:** Drag passwords into the order you want and copy an existing one in a click.
🔹 **Developer Friendly:** Over 25 documented hooks and filters, including filters for every message shown to visitors.
🔹 **Advanced Appearance Customizer:**
   🔹 Custom logo upload with width/height/alignment controls.
   🔹 Background types (color, custom image with cover size options).
   🔹 Custom colors for page background, form cards, primary buttons, text, inputs, labels, and borders.
   🔹 Responsive, sleek layouts (default WordPress login style or customized design).

== Screenshots ==
1. Settings Tab
2. Passwords Tab
3. WooCommerce Protection Tab
4. Appearance Tab
5. Password Protected Page

== Installation ==

1. Upload the plugin folder to the `/wp-content/plugins/` directory, or install the plugin through the WordPress plugins screen directly.
2. Activate the plugin through the 'Plugins' screen in WordPress.
3. Use the 'Password Protected' menu in the WordPress admin sidebar to configure settings.

== Screenshots ==

1. **Settings Panel** – Configure global protection, role-based bypass, authentication type, password form layout, and Google reCAPTCHA from one clean settings screen.
2. **Passwords Manager** – Create and manage multiple passwords with custom labels, scopes (Global, Page, Category, etc.), status controls, and per-password role bypass rules.
3. **WooCommerce Protection** – Protect your entire WooCommerce store or assign individual passwords to specific products and product categories.
4. **Appearance Customizer** – Fully customize the password form with logo upload, background settings, typography, color pickers for every element, and form content options.
5. **Frontend Password Form** – The sleek, responsive password screen visitors see – available in WordPress-native login style or fully customized layout.

== For developers ==

Several settings that are available in the plugin as filters, so you can change them in code without upgrading.

Change the message shown for a wrong password:

`add_filter( 'ppsas_message_incorrect', function () {
    return 'That password is not right.';
} );`

Change the lockout message. The {minutes} placeholder is replaced with the remaining wait:

`add_filter( 'ppsas_message_lockout', function ( $template, $minutes ) {
    return 'Please wait {minutes} minutes before trying again.';
}, 10, 2 );`

Let any signed-in user through, whatever their role:

`add_filter( 'ppsas_visitor_is_exempt', function ( $is_exempt ) {
    return $is_exempt || is_user_logged_in();
} );`

Keep a specific page public while the rest of the site is protected:

`add_filter( 'ppsas_visitor_is_exempt', function ( $is_exempt ) {
    return $is_exempt || is_page( 'pricing' );
} );`

Change how long access log entries are kept:

`add_filter( 'ppsas_log_retention_days', function () {
    return 30;
} );`

The full hook reference is in the plugin documentation.

== Changelog ==

= 1.1.0 =
* SECURITY: Protected content was previously readable through RSS feeds and the REST API even while protection was enabled. Both are now blocked by default, with a setting for each. Existing sites are upgraded to the protected setting.
* Added login attempt limiting with a configurable lockout duration, applied to both the form and the REST endpoint.
* Added an IP allowlist supporting single addresses, CIDR ranges and wildcards.
* Added a configurable session length, plus an optional "Remember me" checkbox with its own duration.
* Added custom wording for the incorrect password and lockout messages.
* Added a page cache compatibility option for sites behind a full-page cache.
* Added drag and drop reordering of the password list, and a Duplicate action for copying a password's settings.
* And more..

= 1.0.6 =
* Added a setting to isolate the password form from theme assets or include them for theme-based styling.
* Preserved the existing theme-asset behavior for upgraded installations.

= 1.0.5 =
* Added Multiple New Features according to users needs.
* Updated WordPress tested compatibility headers to version 7.0.
* Updated feature list and documentation in readme.txt.

= 1.0.4 =
* Fixed bugs

= 1.0.3 =
* Fixed bugs without woocommerce
* Improved User Interface

= 1.0.2 =
* Fixed bugs provided by WordPress Team

= 1.0.1 =
* Fixed bugs provided by WordPress Team

= 1.0.0 =
* Initial release