Password Protected Site and Store
Require a password before visitors can see your WordPress site, individual pages and posts, whole categories, or your WooCommerce store and products — without writing any code.
Built for real jobs
Staging sites & client previews
Lock a site in development or share a preview with one client — you and your editors still browse normally.
Wholesale & members-only stores
Lock the whole WooCommerce store, or single products and categories, while the rest of the site stays public.
Launches & time-limited access
Schedule a password to open on launch day or expire when a client review ends. Nothing depends on cron.
Everything included, free
Whole site or single pages
Protect everything, or pick individual posts, pages, custom post types and taxonomy archives. The most specific rule wins.
How it worksWooCommerce protection
Lock the store, a product category or one product. Prices are hidden and a badge marks protected items.
How it worksUnlimited passwords
Give each group its own password for the same content, then retire one without disturbing the rest.
How it worksScheduled access
Set Active from and Active until dates in your site timezone. Checked on every visit — no cron needed.
How it worksRole, login & IP bypass
Let chosen roles, any signed-in user, or an office IP range straight through without a prompt.
How it worksBrute-force lockout
Lock out an IP after repeated wrong passwords, and add Google reCAPTCHA v2. Passwords are stored as bcrypt hashes.
How it worksFeed & REST API protection
Your content is no longer readable at /feed/ or /wp-json/ while the site is protected.
How it worksBranded password screen
Logo, background, colours, typography and form text — or keep the familiar WordPress look.
How it worksActivity reports
A daily or weekly email of unlocks, failed attempts and the IPs behind them. Quiet periods send nothing.
How it worksAccess Links (PRO)
Let users bypass the password screen completely by giving them a secure link.
Activity log screen (PRO)
Watch unlocks and failed attempts in real time.
Usage limits (PRO)
Expire passwords after they have been used a certain number of times.
Login page protection (PRO)
Lock down wp-login.php alongside the rest of your site.
More exclusions (PRO)
Bypass protection by URL structure, query string, or referring domain.
More Captcha options (PRO)
Cloudflare Turnstile and hCaptcha support.
Custom CSS (PRO)
Add CSS directly to the appearance settings screen.
Inside the plugin
Up and running in minutes
-
Step 01
Install
In WordPress admin go to Plugins → Add New, search for “Password Protected Site and Store”, then Install and Activate.
-
Step 02
Nothing changes yet
Protection stays off until you turn it on, so activating the plugin never locks your site by surprise.
-
Step 03
Lock your site
Open Password Protected → Settings, turn on Enable global protection, set a password and save.
No. Administrators and editors bypass the password by default, and the plugin never protects /wp-admin. You can change the bypass roles, but the default is deliberately safe.
No. It sits in front of your site as a shared-password gate. Your users, roles and logins are untouched.
Yes. Create as many passwords as you like, each scoped to whatever you want to protect. See Protect one page with its own password.
No, and that is the point. A protected site returns the password screen to crawlers as well as people. robots.txt and favicons stay reachable so nothing breaks.
Nothing is deleted. Your passwords, appearance settings and options stay in the database, so reactivating restores everything exactly as it was.
Yes, via Settings → Import / Export. Password values themselves are never included in an export — see Move settings between sites.
Not if you turn on Force protected products unpurchasable. It blocks add-to-cart from related products, shortcodes, product blocks and direct add-to-cart links until the visitor enters the password.
Read the full documentation
29 guides — from installation to troubleshooting.