=== RIACO Content Protector ===
Contributors: prototipo88
Tags: content protection, password, password protection, hide content, restrict content
Requires at least: 6.2
Tested up to: 6.8
Requires PHP: 7.4
Stable tag: 1.0.0
License: GPLv2 or later
License URI: https://www.gnu.org/licenses/gpl-2.0.html

Protect any portion of your WordPress content using a simple shortcode. Includes global password, AJAX unlock, and site-wide instant access.

== Description ==

**RIACO Content Protector** allows you to protect *any part* of your WordPress content using a shortcode.  
Unlike the built-in post password protection, this plugin protects only what you wrap, *not the whole post*.

Perfect for:

* Protecting premium blocks of content  
* Protecting guides, downloads, links, or sensitive sections   
* Paywall-style snippets

### Features

* Protect **only specific content** inside posts/pages  
* Uses a minimal shortcode:  
  `[riaco_content_protector] Hidden text here [/riaco_content_protector]`
* **Global password** stored in plain text, like WordPress page passwords.
* AJAX-based form — no page reload  
* Unlocks **all protected sections** on the site after correct password  
* Optional cookie persistence (remember unlocked content for a configurable number of days)   
* Secure implementation using nonces, hashed tokens, and transients   

**Important:**

* The global password is stored in plain text, just like WordPress page passwords. It can be read by user with 'manage_options' ability.
* If the global password or "Remember Unlocked" duration is changed in settings, all existing unlock cookies are invalidated. Users will need to re-enter the new password to access protected content.

### How It Works

Wrap content you want to protect:

`
[riaco_content_protector]
This text will be hidden until the visitor enters the password.
[/riaco_content_protector]
`

Set the global password under:

**Settings > Content Protector**

Visitors will see a modern, styled form.  
After entering the correct password:

* The content unlocks immediately  
* All other protected areas unlock automatically  
* An optional cookie can keep everything unlocked for a chosen number of days  

### Security

* Nonces on every request  
* Secure HMAC token for cookie authentication  
* Sanitized shortcode attributes  
* Escaped output  
* No sensitive data stored in cookies  
* Global password stored in plain text, like WordPress page passwords. 

### Cookie

We use this cookie to understand if user unlocked the content: `riaco_cp_unlocked_global`.

### Style

You can style the content protector box.

It has this class: `.riaco-cp--container`, so you can add in your `style.css`:

`
.riaco-cp--container {
    background: #f8f9fa;
    padding: 20px;
    border: 1px solid #ddd;
    border-radius: 6px;
}
`

You can replace button classes using:

`
add_filter( 'riaco_cp_button_classes', function( $classes ) {
    return 'button my-custom-button-class';
});
`

Or you can remove button classes:

`
add_filter( 'riaco_cp_button_classes', function( $classes ) {
    // Remove wp-element-button
    return str_replace( 'wp-element-button', '', $classes );
});
`

== Installation ==

1. Upload the plugin folder to `/wp-content/plugins/`
2. Activate the plugin through **Plugins > Installed Plugins**
3. Go to **Settings > Content Protector** and configure your global password
4. Add the shortcode to any post or page

`
[riaco_content_protector] This is hidden. [/riaco_content_protector]
`

== Frequently Asked Questions ==

= Can I protect multiple sections on the same page? =  
Yes. All instances use the same global password and unlock together.

= Does this protect the entire post? =  
No — only the content wrapped in the shortcode.

= Are passwords hashed in the database? =
No, the global password is stored in plain text like WordPress page passwords for easy admin management.

= Does this work with Gutenberg / block editor? =  
Yes. It works in both Classic and Block Editor.  
You can insert the shortcode inside Paragraph block or using Shortcode block.

= What happens when I change the global password? =
All previously unlocked content cookies are invalidated. Users must re-enter the new password.

== Screenshots ==

1. Frontend password form  
2. Protected content example  
3. Settings page with global password option  

== Changelog ==

= 1.0.0 =
* Initial release
* Shortcode protection
* Global password
* AJAX unlock
* Cookie remember feature
* Automatic unlock of all instances

== License ==

This plugin is licensed under GPLv2 or later.