WordPress password-protected content

Implement or review WordPress's built-in shared-password gate without treating it as user authentication or encrypted storage. Preserve the core form/cookie contract, guard every custom output surface, and prevent caches from publishing an unlocked representation.

Read references/runtime-and-extension-contracts.md when working on headless/REST access, replacing the form, changing bypass policy, or auditing exactly which core surfaces are and are not protected.

When to use this skill