post_password_required( int|WP_Post|null $post = null ): bool

Compatibility

Present in every tracked release (6.7.7 to 7.1.0), and compiles on PHP 7.4 through 8.6-dev.

Parameters

$postint|WP_Post|nulloptional

An optional post. Global $post used if not provided.Default: null

Return value

bool

false if a password is not required or the correct password cookie is present, true otherwise.

Code examples

Every example is editable and runs in a real WordPress booted in your browser by WordPress Playground. Press Run, then edit the code: clicking away re-runs it. Nothing is sent anywhere until you do.

$query = new WP_Query( array( 'p' => 2, 'post_type' => 'post' ) );

while ( $query->have_posts() ) :
	$query->the_post();

	if ( post_password_required() ) {
		echo esc_html( 'This post is password protected. Enter the password to view it.' );
	} else {
		echo esc_html( 'Title: ' . get_the_title() );
	}
endwhile;

wp_reset_postdata();

add_filter(
	'post_password_required',
	function ( $required, $post ) {
		if ( current_user_can( 'edit_posts' ) ) {
			return false;
		}
		return $required;
	},
	10,
	2
);

$post     = get_post( 3 );
$required = post_password_required( $post );

printf(
	'Password required for post %d: %s',
	esc_html( $post->ID ),
	esc_html( $required ? 'yes' : 'no' )
);

Common problems and fixes · 4

• Why does post_password_required() still return true for a logged-in administrator?
• Why does passing an invalid post ID silently return false instead of an error?
• I changed post_password directly with a raw SQL query, why doesn't the function see the change?
• My 'post_password_required' filter callback assumes $required starts as false, why does it misbehave?

Alternatives and related functions

get_the_password_form

When you need to render the actual password prompt markup to show visitors instead of just testing whether one is needed.

current_user_can

When access should depend on the visitor's role or capability rather than on whether they know the post password.

wp_check_password

When you're validating a plaintext password against a stored hash outside the post-password cookie flow, such as in a custom login form.

get_post

When you only need the post object itself, including its post_password field, without running the cookie check.

Performance profile

How much work a call to post_password_required() does, and what it touches: the algorithmic scaling, the Zend instruction count per call across PHP versions, the hooks it hands control to, and the core code that calls it. Measured from the compiled opcodes, not a stopwatch, so every number is identical on any machine running the same PHP version, and every function in core is ranked by cost.

Cost class

Heavy

Reaches the database via get_post().

Scaling

Constant

No loop in the body: the same number of instructions runs whatever you pass in.

Instructions

13–47

Executed per call on PHP 8.5, depending on the branch taken. The body compiles to 61.

Plugin surface

1 hook

Third-party callbacks on 'post_password_required' run inside this call, and their cost is not bounded by anything here.

Called by

40

40 places in core call this, so the cost is paid more often than your own code shows.

What it touches

• querycontent queryget_post()called directly
• hookthird-party callbacksapply_filters()called directly

Further down the call graph this can also reach option, cache, serialize and transient. Those are the worst case, several calls deep and usually down an error path, not what a normal call pays.

What one call costs · 3 distinct outcomes

One number would be a lie: the work depends on which branch runs. These are every distinct cost post_password_required() can have, taken from its control-flow graph on PHP 8.5.

Hooks and filters fired · 3

3 hooks fire while post_password_required() runs, in this order:

1. 1
   apply_filters( post_password_required )filterline 887 (+5 into the body)

   Filters whether a post requires the user to supply a password.

2. 2
   apply_filters( post_password_required )filterline 892 (+10 into the body)

   Filters whether a post requires the user to supply a password.

3. 3
   apply_filters( post_password_required )filterline 914 (+32 into the body)

   Filters whether a post requires the user to supply a password.

Uses · 5

• get_post()Retrieves post data given a post ID or post object.
• apply_filters()Calls the callback functions that have been added to a filter hook.
• wp_unslash()Removes slashes from a string or recursively removes slashes from strings within an array.
• str_starts_with()Polyfill for `str_starts_with()` function added in PHP 8.0.
• PasswordHash::__construct()

Used by · 40

• Twenty_Fourteen_Ephemera_Widget::widget()Outputs the HTML for this widget.
• WP_Comments_List_Table::single_row()Generates content for a single row of the table.
• WP_List_Table::comments_bubble()Displays a comment count bubble.
• WP_Posts_List_Table::column_title()Handles the title column output.
• WP_Posts_List_Table::get_no_title_excerpt()Gets a trimmed excerpt to display in place of a missing post title.
• WP_REST_Comments_Controller::check_read_post_permission()Checks if the post can be read.
• WP_REST_Posts_Controller::prepare_item_for_database()Prepares a single post for create or update.
• WP_REST_Posts_Controller::prepare_item_for_response()Prepares a single post output for response.
• _block_bindings_post_data_get_value()Gets value for Post Data source.
• _block_bindings_post_meta_get_value()Gets value for Post Meta source.
• atom_enclosure()Displays the atom enclosure for the current post.
• comments_popup_link()Displays the link to the comments for the current post ID.

Source code

View on Trac ↗View on GitHub ↗

882function post_password_required( $post = null ) {883	$post = get_post( $post );884 885	if ( empty( $post->post_password ) ) {886		/** This filter is documented in wp-includes/post-template.php */887		return apply_filters( 'post_password_required', false, $post );888	}889 890	if ( ! isset( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] ) ) {891		/** This filter is documented in wp-includes/post-template.php */892		return apply_filters( 'post_password_required', true, $post );893	}894 895	require_once ABSPATH . WPINC . '/class-phpass.php';896	$hasher = new PasswordHash( 8, true );897 898	$hash = wp_unslash( $_COOKIE[ 'wp-postpass_' . COOKIEHASH ] );899	if ( ! str_starts_with( $hash, '$P$B' ) ) {900		$required = true;901	} else {902		$required = ! $hasher->CheckPassword( $post->post_password, $hash );903	}904 905	/**906	 * Filters whether a post requires the user to supply a password.907	 *908	 * @since 4.7.0909	 *910	 * @param bool    $required Whether the user needs to supply a password. True if password has not been911	 *                          provided or is incorrect, false if password has been supplied or is not required.912	 * @param WP_Post $post     Post object.913	 */914	return apply_filters( 'post_password_required', $required, $post );915}

Changelog

Introduced in 2.7.0. Unchanged from 6.7.7 through 7.1.0.

1. 6.7.7
2. 6.8.8
3. 6.9.7
4. 7.0.4
5. 7.1.0

Signature, return type and hooks compared across 5 parsed releases.

About this page

Parsed data

Generated from the wordpress-develop 7.1.0 tag, from src/wp-includes/post-template.php, and regenerated for each WordPress release so it tracks the code rather than a snapshot of it.

Corrections

Something wrong on this page? Report it and it gets fixed in the next regeneration.