Reference

Developer hooks

Updated September 27, 2026 2 min read Plugin v1.1.0

The plugin exposes hooks for extending its behaviour. These are stable and documented in the source.

Access control

Hook	Type	Purpose
`ppsas_visitor_is_exempt`	filter	Return `true` to grant access for the whole request.
`ppsas_password_record_is_active`	filter	Add conditions that take a password out of play.
`ppsas_rest_allowed_routes`	filter	Route prefixes that stay public while protected.
`ppsas_trust_proxy`	filter	Return `true` to honour `X-Forwarded-For` behind a trusted proxy.
`ppsas_protectable_post_types`	filter	Post types that get the editor protection box.

Captcha

Hook	Type	Purpose
`ppsas_captcha_providers`	filter	Add providers to the settings screen.
`ppsas_captcha_response_field`	filter	The POST field carrying the response.
`ppsas_verify_captcha`	filter	Verify a response for your provider.
`ppsas_render_captcha`	action	Render your widget in the form.
`ppsas_enqueue_captcha_scripts`	action	Enqueue your provider’s script.

Admin UI

Hook	Type	Purpose
`ppsas_admin_panels`	filter	Register extra panel slugs.
`ppsas_admin_sidebar_items`	action	Add sidebar navigation entries.
`ppsas_admin_panels_render`	action	Render extra panels.
`ppsas_settings_panel_fields`	action	Add fields to the settings form.
`ppsas_save_settings`	action	Save your fields. Nonce already verified.

Logging and reporting

Hook	Type	Purpose
`ppsas_should_log_access`	filter	Return `false` to skip logging an attempt.
`ppsas_access_log_row`	filter	Modify the row before it is written.
`ppsas_access_logged`	action	React to a logged attempt.
`ppsas_log_retention_days`	filter	Change the 90-day retention window.
`ppsas_activity_report_message`	filter	Rewrite the report email body.
`ppsas_send_empty_report`	filter	Return `true` to email even with no activity.
`ppsas_visitor_locked_out`	action	React to a lockout.

Database

Hook	Type	Purpose
`ppsas_create_tables`	action	Create your own tables on activation and upgrade.
`ppsas_table_names`	filter	Register tables with the self-healing check.

Form rendering

Hook	Type	Purpose
`ppsas_login_head`	action	Output into the password screen `<head>`.
`ppsas_isolated_form_assets`	filter	Allow asset handles in isolated mode.
`ppsas_enqueue_scripts`	action	Enqueue assets for the form.

Database tables

Table	Contents
`{prefix}_ppsas_passwords`	Password records: scope, hash, label, status, schedule, role bypass, order.
`{prefix}_ppsas_access_log`	Access attempts: event type, scope, user, IP, browser, timestamp.

Still stuck? Free support runs in the WordPress.org forum so answers help everyone.

Open a support thread