Password protect a WordPress site, page, or category

Sometimes a site should not be public yet: a staging build, a client preview, a members-only area, or a draft section you are not ready to share. WordPress can password protect the whole site, a single post or page, or (with a plugin) an entire category.

This is access control for visitors, not a full security stack. Site-wide password gates do not replace login security, two-factor authentication, updates, or backups. Use them when you need a simple shared secret in front of content.

Which method should you use?

Password protect the entire WordPress site

For a whole-site gate, use a dedicated plugin. A common option is Password Protected by Ben Huson. It asks visitors for one site password before they see WordPress-generated content.

Typical features:

• One password for the whole front end
• Option to let administrators (and sometimes logged-in users) skip the gate
• Optional feed access

Important limit: the plugin protects content WordPress serves. Direct file URLs (for example an image path under wp-content/uploads/) may still open if someone has the link. Treat it as a soft gate for browsing, not file-level ACLs.

Set up Password Protected

1. In the dashboard go to Plugins → Add New Plugin.
2. Search for Password Protected (Ben Huson). Install and activate.
3. Open Settings → Password Protected (or the plugin’s settings link under Installed Plugins).
4. Enable password protection.
5. Under protected permissions, choose whether admins or logged-in users can bypass the password.
6. Enter a strong site password and save.

Visitors who are not exempted will see the password form before the rest of the site.

Other whole-site options

Alternatives in the plugin directory include:

• Hide My Site
• Password Protect WordPress (and similar “PPWP” style plugins)

Pick one maintained plugin, keep it updated, and remove it when the site goes fully public. For staging, many hosts also offer HTTP Basic Auth or IP allowlists at the server level. That sits in front of WordPress and can be cleaner for private previews than a site-wide content password.

Security Ninja notes on maintenance-mode and password-protected sites: docs.

Password protect a single post or page (without a plugin)

You do not need a plugin to lock one post or page. WordPress includes this in the editor.

1. Open the post or page in the block editor.
2. In the sidebar, open the Post (or Page) panel.
3. Find Visibility (under Summary / status). Click to change it.
4. Choose Password protected and enter a password.
5. Update or publish.

Older screenshots still show the classic editor’s Visibility → Edit control. In the block editor the same setting lives in the document sidebar. Behavior is unchanged: visitors see a password form instead of the content until they enter the correct password.

Private (not password-protected) is different. Private posts are only visible to logged-in users with the right role. Password-protected content is for sharing a secret with people who do not need accounts.

This pairs well with least privilege for staff accounts: share a content password when you must, keep admin logins on MFA. Password habits: password management tips.

Password protect a WordPress category

WordPress does not password-protect categories by default. You need a plugin that gates category archives and the posts inside them.

One example is Access Category Password. It replaces protected category content with a password form and can adjust feeds so full post text does not leak.

Typical setup:

1. Install and activate the plugin.
2. Open its settings screen.
3. Set the password, choose which categories are covered, and decide which logged-in roles may skip the form.
4. Optionally protect only single posts in those categories, customize error text, and style the form.
5. Save changes.

For WooCommerce product categories, use a store-aware plugin instead: WordPress password protected categories for WooCommerce.

Plugin UIs change over time. If a plugin is abandoned, switch to a maintained membership or restriction plugin rather than running unmaintained code. That is basic security hardening.

When a password gate is the wrong tool

• Public marketing sites: do not leave a whole-site password up after launch. It hurts SEO and support.
• Real user accounts: membership plugins, roles, and 2FA beat a shared password you email to everyone.
• Stopping hackers: a front-end content password does not harden /wp-login.php. Follow the login security guide for that.
• Galleries and media: password pages do not encrypt files in uploads; treat direct media URLs carefully.

Wrapping up

Use a whole-site plugin when the entire front end should be gated. Use the block editor’s password visibility for one-off posts and pages. Use a category plugin when a whole section needs the same secret. Keep plugins updated, prefer strong unique passwords, and put real admin protection on MFA and hardening rather than on a visitor password form alone.

Related: WordPress security checklist, login protection.