5 ways to password protect your WordPress website and pages

You can password protect a single WordPress page or post with a setting WordPress already has, so you don't need a plugin for that. WordPress has no setting that hides the entire site, though, so to password protect your whole WordPress site you need a plugin or a password on the server. A staging site lets you try out changes without affecting your live site, and a membership plugin controls who can see which content.

How to password protect a WordPress page or post

You set the password in the editor, and it works for a page that's already live as well as for a draft you plan to publish later. In the block editor, it sits under Status in the settings sidebar: click the current status and choose the visibility in the pop-over that opens.

1. Open the page or post in the WordPress editor and find its visibility setting, which is Public by default.
2. Choose Password protected and type the password visitors will need, up to 20 characters.
3. If you use the classic editor, click OK to confirm the new visibility. Then click Publish, or Update if the page is already live, so the setting takes effect.

Visitors still see the page title, with "Protected:" in front of it, but the content is replaced by a short form that asks for the password. WordPress remembers the password in the visitor's browser, so they don't have to type it again when they come back to the same page, unless they have entered another page's password in the meantime. To remove the password later, set the visibility back to Public and click Update.

The password keeps visitors out, but not the people who work on your site: administrators and editors can still open protected pages in the editor without it. If nobody outside your team should see a page at all, choose Private instead. Only administrators and editors can see a private page, and it doesn't appear in your site's lists of pages and posts.

Password protect your whole WordPress site with a plugin

Many WordPress plugins can lock the whole site behind a password. The Password Protect WordPress plugin (PPWP), for example, locks your entire site or selected pages. You set the site-wide password under Sitewide Protection in the Password Protect WordPress menu of your WordPress dashboard, and once you've saved it, any page of your site shows a password form instead of its content. Even in the free version, you can also customise that form so it matches your website.

A password on a page hides the page, but not the images and documents you upload to your Media Library: anyone with a file's own link can still open it. To keep those files private too, you need another plugin. Prevent Direct Access is built to protect the media files you upload to WordPress, such as images, PDFs and videos, and with a paid Pro plan, Download Monitor has an extension that sets access limits per download.

Lock the whole site with a server password

With a server password, the server asks for a username and password before your website opens at all, so every page and every file in the folder you protect is covered. Two files on the server make this work. The .htaccess file tells the server to ask for a login, and the .htpasswd file holds the usernames and passwords it accepts. Visitors get a password box from their own browser rather than a page of your website, so you can't add your logo to it, and the browser decides whether to show the short name you give the protected area. Google says that password protecting content also keeps it out of Google Search, and that content which already appears there will eventually be removed from its results.

On our web hosting, File Manager can create these files for a folder, but that tool is mainly meant for websites built with our classic Website Builder. For a WordPress site, we recommend a password plugin instead: you set it up and switch it off from your WordPress dashboard, and visitors see a password form on your own site rather than the browser's box.

Test changes on a password-protected staging site

If you want to try a new design or a big change without visitors seeing it, you don't need to lock your live site. A staging site is a copy of your website where you can try out plugins, themes and other changes while the public site stays as it is. When you're happy with the result, you copy the changes to the live site. Protect the copy itself with a password plugin or a server password, so visitors and search engines don't find it.

If your hosting has no staging environment, you can set up a staging site yourself. Our Managed hosting for WordPress includes one, and you publish the changes from it with a click. Delete the staging site once you no longer need it: you stop updating a copy you don't use, so leaving it makes your website more vulnerable to hacks.

Create a members-only area with a membership plugin

If you want each person to have their own login, or to charge for access, use a membership plugin. People register and log in, and the plugin controls which content each member can see. MemberPress and SureMembers are paid plugins. With MemberPress you can also sell online courses and digital downloads, while SureMembers locks content for the member groups you set up, down to single blocks on a page. For a news site where some articles are free and others come with a paid subscription, look at Kadence Memberships: it limits access to posts, pages and media, from a single hidden page to a full subscription site.

Which password protection method should you choose?

Our advice: for a draft you want to share or a single private page, use the password setting WordPress already has. For a site under construction that nobody should see yet, lock the whole site with a password plugin rather than a server password, and use one for a staff area too. Test changes to a live site on a staging site, and choose a membership plugin when each person needs their own login.

Keep your password-protected WordPress site safe

Whichever method you choose, keep WordPress, your theme and your plugins up to date. Plugins and themes can be exploited, and that includes the plugin that protects your content. You can switch on automatic updates for each plugin on the Plugins screen. Updates are one part of keeping your site safe, and our WordPress security guide covers the rest.

To have WordPress and your plugins kept up to date for you, choose a Managed hosting for WordPress plan: we install every update, check your site visually after each one and roll it back if something looks wrong.