CUNY Academic Commons

thanks - this is super useful to know full stop. I'll pass it on to Ines.

Boone, the following would allow password protection on the blog page (a.k.a Posts page):

add_action( 'parse_query', function( $q ) {
    // Bail if not main query or blog page.
    if ( ! $q->is_main_query() || ! $q->is_home() ) {
        return;
    }

    // Get blog page ID.
    $id = $q->get_queried_object_id();

    // Bail if blog page is not password protected.
    if ( ! post_password_required( $id ) ) {
        return;
    }

    // If password protected, wipe out posts and show password form.
    add_action( 'loop_start', 'cac_blogpage_postpass_ob_start', -9999 );
    add_action( 'loop_end', 'cac_blogpage_postpass_ob_end_clean', 999 );
    add_action( 'loop_end', function() use ( $id ) {
        echo get_the_password_form( $id );
    }, 9999 );
} );

function cac_blogpage_postpass_ob_start( $q ) {
    // Sanity check.
    if ( ! $q->is_main_query() ) {
        return;
    }

    remove_action( 'loop_start', __FUNCTION__, -9999 );
    ob_start();
}

function cac_blogpage_postpass_ob_end_clean( $q ) {
    // Sanity check.
    if ( ! $q->is_main_query() ) {
        return;
    }

    ob_end_clean();
    remove_action( 'loop_end', __FUNCTION__, 999 );
}

Thanks, Ray! This is very clever. I worry about weird edge cases, though - like when a theme doesn't properly implement the loop, so that loop_start and loop_end hooks aren't fired as expected. It also raises the possibility of weird display issues, because WP's default behavior is to swap out the_content with the password form, which might have different markup as a wrapper than the post loop.

More generally, I am wary of doing magic like this, especially as regards privacy. It feels fragile. And it gives the incorrect indication that hiding an archive page means hiding the individual items on that archive, which is definitely not the case - even with this trick in place, you'd have to hide individual pages as well if you didn't want them accessible via their URLs (or via other, non-blocked archives like the date archives). So it provides a sense of false security.

For these reasons, I recommend against implementing any further changes of this sort.

Feel free to close this