diff --git a/php/add.php b/php/add.php
index 2077af0a..ffffccec 100644
--- a/php/add.php
+++ b/php/add.php
@@ -1,15 +1,12 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
-    log_and_die("Missing POST variables");
-}
+$type = $_POST['list'];
 
-check_cors();
-check_csrf($_POST['token']);
-check_domain();
+// All of the verification for list editing
+list_verify($type);
 
-switch($_POST['list']) {
+switch($type) {
     case "white":
         echo exec("sudo pihole -w -q ${_POST['domain']}");
         break;
diff --git a/php/auth.php b/php/auth.php
index d2345ca4..f6757ffa 100644
--- a/php/auth.php
+++ b/php/auth.php
@@ -105,4 +105,33 @@ function check_domain() {
         }
     }
 }
+
+function list_verify($type) {
+    if(!isset($_POST['domain']) || !isset($_POST['list']) || !(isset($_POST['pw']) || isset($_POST['token']))) {
+        log_and_die("Missing POST variables");
+    }
+
+    if(isset($_POST['token']))
+    {
+        check_cors();
+        check_csrf($_POST['token']);
+    }
+    elseif(isset($_POST['pw']))
+    {
+        require("password.php");
+        if(strlen($pwhash) == 0)
+        {
+            log_and_die("No password set - ${type}listing with password not supported");
+        }
+        elseif($wrongpassword)
+        {
+            log_and_die("Wrong password - ${type}listing of ${_POST['domain']} not permitted");
+        }
+    }
+    else
+    {
+        log_and_die("Not allowed!");
+    }
+    check_domain();
+}
 ?>
diff --git a/php/sub.php b/php/sub.php
index 56019664..fb670f3a 100644
--- a/php/sub.php
+++ b/php/sub.php
@@ -1,15 +1,12 @@
 <?php
 require('auth.php');
 
-if(!isset($_POST['domain'], $_POST['list'], $_POST['token'])) {
-    log_and_die("Missing POST variables");
-}
+$type = $_POST['list'];
 
-check_cors();
-check_csrf($_POST['token']);
-check_domain();
+// All of the verification for list editing
+list_verify($type);
 
-switch($_POST['list']) {
+switch($type) {
     case "white":
         exec("sudo pihole -w -q -d ${_POST['domain']}");
         break;