How to Password Protect a Page or Post in WordPress (2 Easy Ways)

Ever wanted to share a WordPress page with a client, give subscribers access to exclusive content, or prepare a page before launching it publicly?

You don’t need to build a membership site or install a complicated access-control system to do it. WordPress has built-in password protection that lets you restrict access to individual pages and posts in just a few clicks.

In this tutorial, I’ll show you two easy ways to password protect a page in WordPress. I’ll also explain how to fix a common problem: when a supposedly protected page is still visible to everyone.

✏️ TL;DR: To lock a single page or post, use the built-in visibility settings directly inside the WordPress editor. If you prefer to lock your entire site, then use the free Password Protected plugin instead.

Here’s everything we’ll cover:

Method 1: Password-Protect a WordPress Page or Post

If you only need to protect a single page or post, then WordPress includes a built-in feature that handles this out of the box. Setup takes a few minutes and you don’t have to install or configure any additional software.

Step 1: Open the Page or Post Editor

In your WordPress dashboard, navigate to Pages or Posts and click Edit under the item you want to lock down.

Step 2: Enable Password Protection

In the right-hand settings panel, find the ‘Status’ section. By default, anything you publish is visible to anyone on the web.

Click the status shown next to it, which reads ‘Draft’ or ‘Published’ depending on whether the page is live yet.

Then, select Password Protected.

This reveals a text box where you can set your password.

Pick something easy for readers to remember, but difficult for outsiders to guess. Avoid obvious choices like ‘1234’ or ‘password.’

Step 3: Save or Update Your Page

Once everything looks good, click Publish or Update if the page is already live. WordPress applies the password straight away.

To test it, open the page link in an incognito or private browser window. You’ll see a simple form asking for the password before it shows your content:

Method 2: Password-Protect Your Entire WordPress Site

Method 1 locks one page at a time, but it becomes impractical when you need to hide your entire site.

For that, I use the free Password Protected plugin. It places a single password screen in front of your whole site, so a visitor has to type the password before they can reach any page or post.

Step 1: Install the Free Password Protected Plugin

To start, install the free Password Protected plugin from WordPress.org. For step-by-step instructions, check out our guide on how to install a WordPress plugin.

When you first open the plugin, a prompt asks whether to share basic diagnostic data and receive updates. You can choose Allow & Continue or Skip. Skipping takes you directly to the settings screen without locking or limiting any features.

Step 2: Turn On Protection and Set Your Site Password

In your dashboard, go to Password Protected » General to manage all your site locking settings.

At the top of the panel, find the Password Protected Status toggle and switch it on. This is the setting that puts the password screen in front of your entire site.

The Protected Permissions section lets you choose who skips the password screen.

Always check Allow Administrators so you can view your site while logged in. Unchecking it will not lock you out of your dashboard, but you’ll have to type the site password in your own browser before you can see the front end.

The remaining options grant access to specific groups:

• Allow Logged In Users: Lets any registered user skip the password prompt. This works great if your clients already have accounts.
• Allow RSS Feeds & Allow REST API: Allow RSS Feeds makes your feed readable without the password, so only check it if an email service needs your feed. Allow REST API only applies to visitors who are logged in.

Next, scroll down to the New Password fields. Enter your chosen password in the first box and confirm it in the second.

Be sure to save your password in a password manager or another secure place, because the settings screen won’t show it again once you save. If you do lose the password, you can sign into WordPress via your usual login page and then either set a new password or deactivate the plugin.

Finally, click Save Changes to apply protection across your entire site.

Step 3: Check the Password Screen in a Logged-Out Browser

Because you enabled Allow Administrators, your browser bypasses the password screen automatically. To check that password protection is working properly, open a private or incognito window and visit your homepage.

You should see the password screen rather than your regular content. Entering your password will give you access to the full site, confirming that everything is working as expected.

Keep in mind that this method does not protect media files. Direct links to images and PDFs bypass WordPress page settings, so anyone with the file URL can still see them. You’ll need to protect those files using a content protection plugin.

To make your site public at any point, go back to Password Protected » General and turn off the Password Protected Status toggle.

Why Your Password-Protected Page Is Not Working

If your page opens straight away without asking for a password, don’t worry. This is the single most common issue people run into, and it’s almost never caused by a broken setting.

Rule Out Caching Issues

Caching plugins deliver saved static copies of your site, which means you might just be looking at a page saved before you turned the lock on.

If you run a caching plugin, then it’s worth clearing its cache, along with any page caching your hosting company runs, and loading the page again in a private window before you go any further.

Your Browser Already Has the Password

When you enter the correct password, WordPress stores a cookie in your browser. This cookie tells your website that you’ve already been verified, so you can browse without re-typing the password on every page load.

Because that cookie stays active for 10 days, your site will open normally once you test the password. To you, the page looks unprotected but it’s locked for everybody else.

To check what real visitors see, test your URL inside a private or incognito window, which ignores existing browser cookies. If the password screen appears there, your setup is working properly.

If you used the Password Protected plugin, you can force-clear your access cookie. Simply add ?password-protected=logout to the end of your site address, and the plugin will log you out and return you to the lock screen.

The Password Is Case-Sensitive

This issue usually affects visitors rather than site owners. WordPress checks passwords using exact character matching, so it treats Spring2026 and spring2026 as completely different inputs.

An accidental space copied at the end of a string will also trigger an invalid password error.

Mobile keyboards make this error more common, as most devices capitalize the first letter of a text field automatically.

If a reader or client reports a password error, ask them to manually type the password in lowercase and check there are no extra trailing spaces.

The Title Still Shows on Your Blog and Category Pages

Even with protection active, your blog homepage, category pages, and search results still display the post title with a ‘Protected:’ prefix and its featured image. Those listing pages are what WordPress calls archive pages.

Depending on your theme, visitors will see either a password form or a quick notice stating the post is protected.

If revealing the title or image gives away confidential details, you can either edit the title or hide protected posts from those pages entirely using a code snippet.

Here’s the code snippet to remove password-protected posts from your main blog feed and archives, followed by the safest way to add it to your site:

function wpb_password_post_filter( $where = '' ) {
    if (!is_singular() && !is_admin()) {
        $where .= " AND post_password = ''";
    }
    return $where;
}
add_filter( 'posts_where', 'wpb_password_post_filter' );

This snippet tells WordPress to bypass password-protected posts whenever it builds your homepage or an archive page. The post remains fully accessible to anyone using its direct link and password.

You could paste this code straight into your theme’s functions.php file. I don’t recommend it, because a single typo in that file can break your site and lock you out of your own dashboard.

Instead, use a snippet plugin like the free WPCode plugin. WPCode keeps custom code separate from your theme files, so you can toggle snippets on and off from the dashboard. Your custom code will also survive when you update or change themes.

You can read our complete WPCode review for more information.

First, you need to install and activate WPCode. For step-by-step instructions, follow our guide on how to install a WordPress plugin.

In your WordPress dashboard, go to Code Snippets » Add Snippet. Hover over the ‘Add Your Custom Code (New Snippet)’ box and click ‘+ Add Custom Snippet’ when it appears.

On the next screen, choose your code type by selecting PHP Snippet.

Start by giving your snippet a clear title, such as ‘Hide Password-Protected Posts,’ so you can identify it easily in your dashboard later.

Next, paste the PHP snippet into the Code Preview box:

Finally, toggle the switch from Inactive to Active and click Save Snippet.

To check this worked, reload your homepage in a private browser window. The protected post’s title and thumbnail will no longer appear in your blog and category pages, while the post itself remains fully accessible via its direct address.

For more details, see our guide on how to hide password-protected posts from the WordPress loop. If you’d rather keep the post listed but show a teaser under the title, then we also have a guide on how to show the excerpt of a password-protected post.

FAQs: Password-Protect Pages and Posts in WordPress

Additional Resources: WordPress Page and Post Management

We hope this article helped you password-protect pages or posts in WordPress. Next up, you might want to check out our helpful guides on:

• Ultimate Guide to Protect Content in WordPress
• How to Create a Paywall in WordPress (with Preview Option)

If you liked this article, then please subscribe to our YouTube Channel for WordPress video tutorials. You can also find us on Twitter and Facebook.