Description
Private Content Login Protector lets you gate any piece of WordPress content behind a login screen that is entirely separate from the normal WordPress login (wp-login.php) and the wp_users table.
Key features:
- Fully custom login, forgot-password and reset-password pages served at
/private-login/ - Independent user table (
wp_pclp_users) with its own roles (Plugin Admin, Manager, Viewer) - Per-post “Protect this content” metabox for Pages, Posts, WooCommerce Products, and any public Custom Post Type
- Product category protection field
- Bulk protection toggles (all products / all categories / all pages / all posts / specific CPTs)
- Fully theme-able login screen (heading, sub-heading, logo, colors, border radius, font, card width)
- Configurable session timeout, login attempt limits with lockout, and password reset token expiry
- Activity log (login, logout, failed login, password reset) with IP + browser
- CSV import/export of users, JSON import/export of settings
- Shortcodes: [private_login], [private_logout], [current_private_user] (also available as the prefixed aliases [pclp_login], [pclp_logout], [pclp_current_user])
- Elementor and WooCommerce compatible
- Translation-ready
Installation
- Upload the
private-content-login-protectorfolder to/wp-content/plugins/. - Activate the plugin through the “Plugins” menu in WordPress.
- Go to “Private Content Login” in the admin menu to configure the login page design and behaviour.
- On first activation, a default account (username
admin) is created — check the admin notice for the generated password and change it immediately from the Users screen. - Open any Page, Post, Product, Product Category, or Custom Post Type and check “Protect this content” in the metabox / category screen, or use the bulk protection toggles in Settings.
FAQ
-
Does this replace the WordPress login?
-
No. WordPress admin login (wp-login.php) and the wp_users table are completely untouched. This plugin manages its own separate set of users and sessions purely for gating front-end content.
-
Does it work with WooCommerce and Elementor?
-
Yes. Product pages, product categories, and the shop page can be protected, and the login templates render independently of page builders so there are no layout conflicts.
Reviews
July 24, 2026
Really impressed with this plugin. It was easy to set up, and I like that it uses its own login system instead of creating WordPress users. The content protection options are flexible, and the login page is easy to customize to match the site’s branding.
It works smoothly with WooCommerce and Elementor, and the extra security features are a nice bonus. Overall, it’s a reliable plugin that does exactly what it promises. Highly recommended!
Contributors & Developers
“Private Content Login Protector” is open source software. The following people have contributed to this plugin.
Contributors
Translate “Private Content Login Protector” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.2.0
- Removed: the Custom CSS field has been removed entirely (settings UI, storage, and output). All other design options (colors, logo, background image, border radius, font, card width) are unaffected. Any Custom CSS value saved by a previous version is automatically cleared from the database.
- Added: prefixed shortcode aliases [pclp_login], [pclp_logout], and [pclp_current_user], registered alongside the existing [private_login], [private_logout], and [current_private_user] shortcodes (which continue to work unchanged).
- Confirmed: every plugin-owned function, class, constant, option, hook, and meta key already uses a unique
Pclp/pclp_/PCLP_prefix or namespace.
1.1.1
- Hardened: Custom CSS is now sanitized with a dedicated, stricter routine (tag/
</style>-breakout stripping, legacy CSS script-vector removal) both when saved and again at output time. - Hardened: Settings JSON import and Users CSV import now verify the actual uploaded file type (not just the client-supplied file name/extension) before processing.
- Hardened: imported settings JSON is now whitelisted and re-sanitized field-by-field instead of being merged in as-is, so an import can never introduce unexpected option keys or unsanitized values.
- Hardened: CSV user export now neutralizes cells that could be interpreted as spreadsheet formulas (CSV/formula injection protection) when opened in Excel/Sheets/etc.
- Improved: minor output-escaping consistency pass across the admin Users screen.
1.1.0
- Fixed: protected Product Category archives now correctly redirect guests to the custom login page and return them to the same category after login. The old URL builder could produce a link whose path didn’t match its query string under certain permalink setups (this is what caused the login screen to sometimes not appear at all); auth URLs are now built explicitly per action and work under both pretty permalinks and plain “?query-string” permalinks.
- Added: individual (per-item) protection via searchable, AJAX-backed multi-select fields for Products, Product Categories, Pages, Posts, and any Custom Post Type — usable independently of, or together with, the existing bulk “Protect all…” toggles. Selections can be edited later from the same screen.
- Added: Product Tag archives can now also be protected (term-level checkbox on the Tags screen, same as Product Categories).
- Added: protected products/pages/posts are now excluded from front-end search results for logged-out guests instead of leaving them fully searchable.
- Added: protected pages/templates are no longer served from page caches — a protected response now sends no-cache headers and sets DONOTCACHEPAGE.
- Added: rewrite rules automatically re-flush after a plugin update, so the pretty-permalink login URL never goes stale.
- Added: Elementor editor/preview mode is no longer redirected away from protected content, so templates can still be edited normally.
- Improved: dashboard “Protected” counts now include individually-selected items, not just the per-item checkbox.
1.0.0
- Initial release.