Set up WooCommerce Protected Categories (Barn2) with passwords, roles, or users. Test add to cart, cache pitfalls, and store hardening that still matters.
Topics WooCommerce & ecommerce Login & access
Lars Koudal Updated Published
Not every product should be public. Wholesale pricing, VIP drops, employee stores, and age-sensitive catalogs need access control. WooCommerce does not ship rich category locks by default, so many stores use a dedicated WooCommerce Protected Categories plugin.
This post covers WooCommerce Protected Categories by Barn2: what it is good for, how setup usually works, how to validate add to cart when locked, and the security limits of “password on a category.”
For whole-site or blog-category gates (not store catalogs), see password protect a WordPress site, page, or category.
Barn2’s WooCommerce Protected Categories lets you restrict product categories so only the right people see (and buy) those items. Typical uses:
Access control for merchandising is not the same as full site security. It helps segmentation and pricing hygiene. It does not replace HTTPS, MFA, updates, or malware monitoring.
Assign one or more passwords to a category. Visitors enter the password before they see products. Simple for temporary campaigns. Shared passwords leak; rotate them when a campaign ends.
Restrict by WordPress user roles (for example a wholesale role) or by specific accounts. Better for ongoing B2B than a single shared password. Apply least privilege so wholesale customers are not Administrators.
Protect a parent category and subcategories/products generally follow. Mixed public/private assignments can create surprises if a product also sits in a public category. Test as a logged-out user and as each role you care about.
Options to keep protected categories out of menus, widgets, and search reduce casual discovery. Determined people may still guess URLs; treat hiding as UX, not cryptography.
Exact UI labels can change with plugin versions. The usual path:
If anything fails after a cache plugin update, bypass or exclude protected archives from full-page cache and retest.
Gating the category archive is not enough if a product URL or cart endpoint still accepts purchases.
Test matrix:
| Actor | Category page | Product page | Add to cart | Checkout | | --- | --- | --- | --- | | Guest (locked) | Password / deny | Deny or password | Must fail | Must fail | | Wrong password | Deny | Deny | Must fail | Must fail | | Correct password / role | Visible | Visible | Allowed | Allowed |
Also check:
If add to cart still works while the category looks locked, treat that as a failed setup until fixed on staging.
A clear password form, sensible redirect into the category, and a human message for denied access reduce support tickets. Match brand colors if you want. Do not bury the unlock flow under dark patterns.
Category locks sit on top of a normal WooCommerce site. Harden the store too:
Password-protected categories reduce accidental exposure. They are not a substitute for server hardening or a WAF when bots and scanners hit the shop. Cloud Firewall helps with known-bad traffic; category plugins do not.
WooCommerce Protected Categories is a practical way to gate wholesale, VIP, or private catalogs without building a second store. Use role-based access for lasting segments, treat shared passwords as temporary, validate add to cart while locked, and keep normal ecommerce security in place. Exclusivity helps merchandising. Patching, MFA, and honest payment architecture protect the business.
Found this useful? Share it.
A Barn2 plugin that restricts product categories so only people with the right password, role, or user account can see and buy those products. Common for wholesale, VIP, and private catalogs.
Yes. Assign password, role, or user rules on the category, test as a guest and as each role, and confirm add to cart fails when locked. Prefer roles for long-lived B2B access.
No. It is merchandising access control. You still need HTTPS, admin 2FA, updates, backups, and a firewall against bots.
