Review the system in context, not as a public sandbox.

function qavirio_demo_gateway_ready() {
    return qavirio_demo_target_configured()
        && qavirio_demo_remote_ready(false);
}

function qavirio_demo_gate_cookie_valid() {
    $raw = (string) ($_COOKIE['qv_demo_gate'] ?? '');
    if (!$raw || strpos($raw, '.') === false) return false;

    [$exp, $sig] = array_pad(explode('.', $raw, 2), 2, '');
    if (!ctype_digit($exp) || (int) $exp < time()) return false;

    $expected = hash_hmac('sha256', $exp, wp_salt('auth'));
    return hash_equals($expected, $sig);
}

function qavirio_demo_gate_set_cookie() {
    $exp = time() + 60 * 60;
    $token = $exp . '.' . hash_hmac(
        'sha256', (string) $exp, wp_salt('auth')
    );
    setcookie('qv_demo_gate', $token, [
        'expires' => $exp,
        'path' => '/',
        'secure' => true,
        'httponly' => true,
        'samesite' => 'Strict',
    ]);
}