Goal: require a password before anyone can see any part of your site.
Use this for: a site in development, a client preview, an internal resource, or anything not ready for the public.
Steps
- Go to Password Protected → Settings.
- Turn on Enable global protection.
- Type a password into Global password.
- Click Save settings.
That is the whole process. Your site is now protected.
What visitors see
A password screen instead of your site. Once they enter the password they can browse normally for 1 day by default.
What you see
Nothing different — administrators and editors bypass the password automatically. This is why you cannot lock yourself out by following these steps.
The admin bar now shows a padlock and “Site protected” while you browse.
Things worth knowing
- Feeds and the REST API are protected too. Your posts are no longer readable at
/feed/or/wp-json/. This is deliberate, and new in version 1.1.0. - Search engines cannot index the site while it is protected.
- You cannot read the password back later. It is stored as a one-way hash. Save it somewhere safe now. To change it, use the Edit password button.
Next steps
- Verify it actually worked → Workflow 3
- Make the password screen look like your brand → Workflow 10
- Protect against guessing → Workflow 12