# Ask for the Password Again Before Sensitive Admin Screens

> Requires administrators to log in again before opening plugin, theme, user and update screens when their login is older than 30 minutes, so a hijacked session cannot quietly install code or add users.

- Type: PHP
- Runs: Admin only
- Category: [Security](https://wpide.com/library/category/security/)
- Tags: login, sessions, hardening
- Author: WPIDE Team
- Installs: 0
- Updated: 2026-10-28
- Page: https://wpide.com/library/sec-reauth-sensitive-screens/

## Code

```php
// Maximum age of the login, and the admin screens that need a fresh one.
$wpide_reauth_minutes = 30;
$wpide_reauth_screens = array( 'plugins.php', 'plugin-install.php', 'plugin-editor.php', 'theme-install.php', 'theme-editor.php', 'user-new.php', 'update-core.php', 'users.php' );

foreach ( $wpide_reauth_screens as $wpide_screen ) {
    add_action( 'load-' . $wpide_screen, function () use ( $wpide_reauth_minutes ) {
        if ( wp_doing_ajax() || 'POST' === ( isset( $_SERVER['REQUEST_METHOD'] ) ? $_SERVER['REQUEST_METHOD'] : 'GET' ) ) {
            return;
        }

        $token   = wp_get_session_token();
        $session = $token ? WP_Session_Tokens::get_instance( get_current_user_id() )->get( $token ) : null;

        if ( ! empty( $session['login'] ) && ( time() - (int) $session['login'] ) <= $wpide_reauth_minutes * MINUTE_IN_SECONDS ) {
            return;
        }

        $here = set_url_scheme( 'http://' . ( isset( $_SERVER['HTTP_HOST'] ) ? sanitize_text_field( wp_unslash( $_SERVER['HTTP_HOST'] ) ) : '' ) . ( isset( $_SERVER['REQUEST_URI'] ) ? esc_url_raw( wp_unslash( $_SERVER['REQUEST_URI'] ) ) : '' ) );
        wp_safe_redirect( wp_login_url( $here, true ) );
        exit;
    } );
}
```

## Notes

Adjust $wpide_reauth_minutes and the list of screens; after logging in again the user lands back on the screen they asked for.

## How to use it

Install the free WPIDE plugin (https://wordpress.org/plugins/wpide/), find "Ask for the Password Again Before Sensitive Admin Screens" in its snippet library and add it in one click; or create a new PHP snippet in WPIDE (or any code snippets plugin) and paste the code above. More snippets: https://wpide.com/library/