This plugin lets you require a password before visitors can see your WordPress site, individual pages and posts, whole categories, or your WooCommerce store and products — without writing any code.
Quick start
If you have just installed the plugin and want the site locked in under a minute:
- Go to Password Protected → Settings in your WordPress admin sidebar.
- Turn on Enable global protection.
- Type a password into Global password.
- Click Save settings.
Your site now asks for that password. You, as an administrator, still get straight through — administrators and editors bypass the password by default.
For the full version of this with screenshots of every decision point, see Lock your entire site.
Before you start
A few things worth knowing up front, because they surprise people:
- You will not be locked out. Administrators and editors bypass the password by default. You can change this, but the default is deliberately safe.
- Protection is off until you turn it on. Installing and activating the plugin changes nothing on your site until you enable protection.
- The password is not a user account. Visitors do not log in or create accounts. They type one shared password and are let through.
- Feeds and the REST API are protected too. As of 1.1.0 these are locked by default alongside your pages. See Feed and REST API protection for why that matters.
What is where in the admin
The plugin adds one menu, Password Protected, with five screens:
| Screen | Purpose |
|---|---|
| Overview | Opens the Passwords screen. The landing page for the plugin. |
| Passwords | Create, schedule, reorder, duplicate and delete passwords. |
| WooCommerce Protection | Lock your whole store, or individual products and product categories. |
| Appearance | Design the password screen visitors see. |
| Settings | Global protection, security, sessions, messages, import and export. |
All five are also reachable as tabs within a single page, so you can move between them without losing your place.
Getting help
If something is not behaving the way this documentation describes, start with Troubleshooting — it covers the problems that come up most often, including caching, visitors being asked for the password repeatedly, and getting locked out.
Features
- Whole site or single pages: Protect everything, or pick individual posts, pages, custom post types and taxonomy archives. The most specific rule wins.
- WooCommerce protection: Lock the store, a product category or one product. Prices are hidden and a badge marks protected items.
- Unlimited passwords: Give each group its own password for the same content, then retire one without disturbing the rest.
- Scheduled access: Set Active from and Active until dates in your site timezone. Checked on every visit — no cron needed.
- Role, login & IP bypass: Let chosen roles, any signed-in user, or an office IP range straight through without a prompt.
- Brute-force lockout: Lock out an IP after repeated wrong passwords, and add Google reCAPTCHA v2. Passwords are stored as bcrypt hashes.
- Feed & REST API protection: Your content is no longer readable at /feed/ or /wp-json/ while the site is protected.
- Branded password screen: Logo, background, colours, typography and form text — or keep the familiar WordPress look.
- Activity reports: A daily or weekly email of unlocks, failed attempts and the IPs behind them. Quiet periods send nothing.
- Access Links (PRO): Let users bypass the password screen completely by giving them a secure link.
- Activity log screen (PRO): Watch unlocks and failed attempts in real time.
- Usage limits (PRO): Expire passwords after they have been used a certain number of times.
- Login page protection (PRO): Lock down wp-login.php alongside the rest of your site.
- More exclusions (PRO): Bypass protection by URL structure, query string, or referring domain.
- More Captcha options (PRO): Cloudflare Turnstile and hCaptcha support.
- Custom CSS (PRO): Add CSS directly to the appearance settings screen.