Who can skip the password

Goal: stop asking people who should not have to type it.

You have three options, which can be combined.

Option A: by role

Best for: your own team who have WordPress accounts.

Go to Password Protected → Settings → Role bypass.
Tick the roles that should skip the password.
Save.

Administrator and Editor are ticked by default.

Option B: any signed-in user

Best for: membership sites where having an account is the real requirement.

Turn on Bypass for all logged-in users.
Save.

Option C: by IP address

Best for: an office, a VPN, or people without WordPress accounts.

Go to Settings → Allowed IP addresses.
Add entries, one per line:

203.0.113.10
192.168.1.0/24
192.168.1.*

Save.

Your current IP address is shown beneath the field, so you can add yourself without looking it up.

Format	Matches
`203.0.113.10`	That exact address
`192.168.1.0/24`	Every address in the range
`192.168.1.*`	Every address with that prefix

IPv6 works the same way, including 2001:db8::/32.

Warning about home IPs: most home internet connections get a new address periodically. An allowlisted home IP will stop working without warning. Use role bypass for individuals and save the IP allowlist for offices and VPNs with fixed addresses.

IP allowlist

Default: empty.

At Settings → Allowed IP addresses, list addresses that skip the password entirely. One per line. Three formats are accepted:

Format	Example	Matches
Single address	`203.0.113.10`	That exact address
CIDR range	`192.168.1.0/24`	Every address in the range
Wildcard	`192.168.1.*`	Every address with that prefix

Both IPv4 and IPv6 are supported, including IPv6 CIDR such as 2001:db8::/32.

The settings screen shows your current IP address beneath the field so you can add yourself without looking it up.

Note on proxies: by default the plugin uses the direct connection address and ignores the X-Forwarded-For header, because that header can be forged by anyone. If your site sits behind a trusted reverse proxy or CDN, a developer can opt in with the ppsas_trust_proxy filter — see the developer appendix.

Advanced Exclusions (PRO)

You can choose to keep specific pages, posts, products, or whole URL paths completely public while the rest of your site remains locked.

To set this up, go to Password Protected → Settings → Exclusions and enter the IDs or URL paths you wish to exclude.