Table of contents

Why password-protect 1. Built-in feature 2. Use a plugin 3. Use .htpasswd and .htaccess 4. Password-protect 5. Make your entire WordPress site private Extra security FAQs Getting started Additional resources

Get the industry’s fastest hosting for WordPress ◦ 99.999% uptime
◦ Comprehensive security
◦ 24/7 support

WordPress Guide → Security → Password Protect

How to password-protect your WordPress site

Want to restrict access to your WordPress site or certain content? Whether you’re building a private portfolio, staging a client project, or securing internal content, password protection gives you quick control over who sees what.

Let’s look at the easiest ways to password-protect your site, from built-in features to advanced plugins.

Why password-protect a WordPress site?

There are plenty of reasons you might want to limit access:

Keep a staging or development site private while you work on it.
Restrict internal documentation or team portals.
Offer client previews without giving public access.
Create members-only or customer-only areas.
Hide an entire store or product category until launch.

No matter the use case, WordPress has flexible tools to help.

1. Use WordPress’s built-in feature to protect a page or post

If you only want to protect a single page or blog post, you don’t need a plugin. WordPress includes a simple password feature out of the box:

Log in to your WordPress dashboard.
Go to Pages or Posts and click Edit on the one you want to protect.
In the right-hand sidebar under Visibility, click Public and select Password Protected.
Enter your password.
Click Update or Publish to save the change.

Only people with the password will be able to view the page. This method is best for simple use cases but doesn’t allow for multiple passwords or advanced access control.

2. Use a plugin to password-protect your entire WordPress site

To protect your whole site or multiple areas at once, a plugin is the way to go. The most popular option is the free Password Protected plugin.

Here’s how to set it up:

Go to Plugins > Add New and search for “Password Protected.”
Click Install Now, then Activate.
Go to Settings > Password Protected.
Check “Enabled” to turn on protection.
Enter a password under New Password.
Optionally allow access for logged-in users or admins.
Click Save Changes.

Once enabled, anyone trying to access your site will see a login prompt. This is ideal for under-construction websites, private client work, or gated content.

3. Use .htpasswd and .htaccess for server-level protection

If you’re using an Apache server and want an extra layer of security, you can password-protect your entire site at the server level using .htaccess and .htpasswd.

Create a .htpasswd file with an encrypted username and password using an online generator.
Upload the .htpasswd file to a secure directory above your site root.
Add the following lines to your .htaccess file (usually found in the root folder):
AuthType Basic
AuthName “Restricted Area”
AuthUserFile /full/path/to/.htpasswd
Require valid-user

This method blocks access before WordPress even loads. It’s best used on staging sites or highly sensitive projects.

4. Password-protect WooCommerce categories or stores

If you run an online store, you might want to hide entire product categories or the full storefront. WordPress doesn’t support this natively, but there are plugins built specifically for WooCommerce.

Two of the most popular (and paid) options are:

Password Protected Categories: Lets you lock individual WooCommerce categories, blog categories, or custom taxonomies with a password.
WooCommerce Private Store: Hides your entire shop from public view until someone enters the correct password or logs in.

Both plugins are maintained by Barn2 and offer user-friendly setup screens, customizable messages, and flexible password control.

5. Make your entire WordPress site private (no plugin required)

If you prefer not to use a plugin, there are still ways to make your site private:

Enable search engine discouragement: Go to Settings > Reading and check “Discourage search engines from indexing this site.” This doesn’t block access but helps keep it hidden.
Use a membership plugin: Tools like MemberPress or Restrict Content can make the site fully private until a user logs in.
Enable maintenance mode: Plugins like WP Maintenance Mode or SeedProd let you display a coming soon page while hiding the main content.

Extra security: Set password expiration and limit access

If you want to level up your password protection, use a plugin like PPWP – Password Protect WordPress. It adds features like:

Multiple passwords per page
Password expiration and scheduling
Role-based access
IP whitelisting

These tools are especially useful for content that changes frequently, like client deliverables, short-term campaigns, or internal reports.

Password protected WordPress FAQs

Yes. You can use built-in tools to protect individual posts or pages, or install a plugin like Password Protected to restrict access to the whole site.

The simplest method is using the Password Protected plugin. You can also use membership plugins, a maintenance mode plugin, or .htaccess protection for tighter control.

Use strong passwords, two-factor authentication, a firewall plugin (like Wordfence), and SSL. Regular updates and backups are essential too.

Use security plugins to limit login attempts, change the login URL, and enable CAPTCHA or 2FA. Good options include WPS Hide Login and Wordfence Login Security.

Next steps for password-protecting your WordPress site

Password protection is one of the fastest ways to add privacy to your WordPress content—whether you’re hiding a full site or just one page. It’s simple to implement and easy to customize.

Start by deciding whether you need protection for a single post or your entire site. Then choose the right method: WordPress’s built-in tool, a plugin, or server-level settings.

Ready to upgrade your WordPress experience? Professional hosting improves speeds, security, and reliability for a website and a brand that people find engaging and trustworthy.

Don’t want to deal with server management and maintenance? Our fully managed hosting for WordPress is the best in the industry. Our team are not only server IT experts, but WordPress hosting experts as well. Your server couldn’t be in better hands.

Click through below to explore all of our hosting for WordPress options, or chat with a WordPress expert right now to get answers and advice.