Protection scopes
A scope is what a password applies to. When you create a password you choose one:
| Scope | Protects | Notes |
|---|---|---|
| Global | The entire site | The broadest option. One password for everything. |
| Any public post type | A single post, page, product or custom post type entry | The dropdown lists every public post type registered on your site, so custom types appear automatically. |
| Any public taxonomy | A category, tag or custom taxonomy archive | Listed as tax_<name>. Protecting a category archive protects that archive page. |
| Product (WooCommerce) | A single product | Managed from the WooCommerce Protection screen or the product editor. |
| Product category (WooCommerce) | Every product in that category | A category password unlocks all products inside it. |
| Store-wide (WooCommerce) | Shop, cart, checkout, account and all products | Separate from global protection, so you can lock the store but leave the blog open. |
How the plugin decides what to protect
When someone requests a page, the plugin works through these steps in order and stops at the first one that applies:
- Skip entirely — admin screens, AJAX, cron,
robots.txtand favicons are never protected. - Feeds — handled separately (see Feed and REST API protection).
- Visitor exemptions — role bypass, logged-in bypass and the IP allowlist. If any applies, the visitor goes straight through.
- Page-level protection — the most specific rule wins.
- Taxonomy / category archive protection.
- WooCommerce store-wide protection.
- Site-wide (global) protection — the least specific rule, checked last.
Why the order matters: a page-specific password takes precedence over the global one. If your whole site is protected with password A and one page also has password B, a visitor on that page is asked for B.