Troubleshooting

Visitors see the site without a password

Most likely: caching. A page cache is serving copies stored before you turned protection on.

Clear every cache: your caching plugin, your CDN, and any host-level cache.
Turn on Settings → Page cache compatibility.
Test again in a private window.

Other causes:

Cause	Check
You are testing while signed in	Use a private window
The visitor’s role bypasses it	Settings → Role bypass
“Bypass for all logged-in users” is on	Settings
Their IP is allowlisted	Settings → Allowed IP addresses
The password is out of schedule	Passwords screen, Schedule column

Visitors are asked for the password repeatedly

Most likely: the session is too short, or cookies are being stripped.

Check Settings → Stay unlocked for (days) is not 0.
If it is 1 or more and the problem continues, a proxy or cache may be stripping cookies. Try switching Authentication type to Transient (IP-based).

Transient mode has a real trade-off: everyone sharing an IP address — an office, a school, a mobile network — shares the unlocked state. Only use it if cookies genuinely do not work.

I am locked out of my own site

You cannot be locked out of /wp-admin — the plugin never protects it in the free version. Sign in as usual and turn protection off.

If you are locked out of WordPress itself, that is unrelated to this plugin; use the standard WordPress password reset.

If you triggered the attempt lockout, wait out the lockout period, or sign in to wp-admin (which bypasses it) and lower the limit.

The password screen looks broken

Settings → Theme Assets on Password Protected Form — try switching between Default and Include Theme Styles/Scripts.
Check Password form layout is set to Customized if you expect your appearance settings to show.
Clear caches and retest.

Feeds or the REST API still return content

Confirm Protect RSS feeds and Protect the REST API are on in Settings.
These gates apply while site-wide protection is on. If you are only protecting individual pages, they do not apply.
Clear any cache in front of the feed.

The activity report never arrives

Confirm Send activity report by email is on and the screen shows a next report time.
No email is sent for a period with no activity — this is expected on a quiet site.
Reports need WP-Cron. If your host has disabled it, set up a real cron job.
Check your site can send email at all — test with any mail-logging plugin.

A password stopped working

Check its Status on the Passwords screen — is it Inactive?
Check the Schedule column — is it marked Out of schedule?
Confirm the scope still points at content that exists. A deleted page leaves a rule pointing at nothing.

Protected products can still be bought

Turn on WooCommerce Protection → Force protected products unpurchasable.

Without it, protected products remain purchasable through related products, shortcodes and direct add-to-cart links, even though the product page itself is protected.