Goal: confirm protection works for real visitors, not just in theory.
This matters because you bypass the password as an administrator, so your own browser is not a fair test.
Steps
- Open a private or incognito window. This is the important part — your normal window is signed in and bypasses the password.
- Visit your site’s home page. You should see the password screen.
- Also check:
yoursite.com/feed/— should refuse accessyoursite.com/wp-json/wp/v2/posts— should return a 401 error
- Enter your password. You should reach the site.
- Navigate to a few other pages to confirm you stay unlocked.
If the site is not protected
| What you see | Likely cause |
|---|---|
| Your site loads normally | Protection is off, or you are signed in. Check you are in a private window. |
| The homepage is protected but other pages are not | A caching plugin is serving stored copies. See Troubleshooting. |
| Feeds still work | Check Protect RSS feeds is on in Settings. |