Add to Preferred Sources
WordPress password protect page is a built-in feature that locks any page or post behind a single password — visitors see a prompt, enter the code you set, and access the content; everyone else sees a blank gate. For South African professional services firms sharing draft proposals, distributors circulating trade price lists, or construction companies posting project documents, it is the fastest way to share a URL with a specific audience without making the content publicly visible.
This guide is part of the South African website builders guide and covers every layer of WordPress page protection: the native method, its real limitations, and a decision table that tells you exactly when to reach for a plugin instead.
The native tool takes about thirty seconds to configure and needs no third-party code. The tricky part is knowing what it actually protects — and what it quietly leaves open.
Files embedded in a protected page (PDFs, images, spreadsheets) remain reachable via their direct URL. Search engines can see the page title even if they cannot read the body. And if you run a caching plugin, a visitor who correctly enters the password may inadvertently let the next visitor skip the gate entirely. None of these gaps are fatal, but each one requires a deliberate response.
Quick Answer
To wordpress password protect page content using the native method: open the page in the Block Editor, click the visibility control in the Summary panel (it shows "Public" by default), select Password Protected, enter your password, and publish or update. WordPress stores the password as a hash in the database and sets a browser cookie — lasting approximately 10 days — when a visitor authenticates correctly. The native method supports one password per page, does not protect embedded media files, and does not automatically prevent the page from appearing in Google search results. For multi-user access, multiple passwords, or category-wide protection, a free plugin is the right next step.
Jump To
What the Built-In Method Covers — and What It Misses
Which Protection Fits Your Situation?
SEO and Indexing After You Lock a Page
Need a secure client-facing portal, not just a locked page?
Send us your current setup and we will show you which protection layer fits your workflow and your budget.
Get a free recommendationWordPress Password Protect Page: The Native 4-Step Method
WordPress's built-in password protection requires no plugin installation and works across every WordPress theme and page builder. The four steps below apply to the Block Editor (Gutenberg), which is the standard editor on every WordPress installation from version 5.0 onwards. If you want to password protect page content in WordPress without installing extra code — a client proposal, a wholesale sheet, a draft landing page — this is the path.
- Open the page editor. Go to Pages → All Pages in your WordPress dashboard and click the page you want to restrict. The Block Editor opens.
- Find the Visibility setting. In the right-hand Settings panel, scroll to the Summary section. The visibility control shows "Public" by default. Click it.
- Select Password Protected and set your password. A dropdown offers three options — Public, Private, and Password Protected. Choose Password Protected. A password field appears. Enter a strong, unique password (use your browser's password generator if you do not have a convention). The password is stored as a hash in the WordPress database.
- Publish or update. Click Publish (for a new page) or Update (for an existing one). WordPress immediately gates the page. Visitors who arrive see a default prompt: the page title prefixed with "Protected:" and a single password field.
The "Protected:" title prefix. Once you lock a page, its title changes to "Protected: [Your Page Title]" everywhere it appears — in browser tabs, in your site's navigation menus, and in search results if the page is indexed. If you share the URL with a client and the tab reads "Protected: Q3 Proposal — Acme Corp", that label is visible before they authenticate. You can override this with a small filter in your child theme's functions.php, but the built-in method has no settings panel for it.
When a visitor enters the correct password, WordPress sets a browser cookie that remains valid for approximately 10 days. During that window, returning to the same page does not require re-entry. After the cookie expires — or if the visitor clears their cookies — the password prompt reappears. The WordPress page password itself does not expire on a schedule; it stays active until you manually change or remove it in the page editor.
What the Built-In Method Covers — and What It Misses
The scope of the wordpress password protect page feature is deliberately narrow: it gates the content of one specific page or post, nothing more. Understanding that scope prevents the most common support calls — a client who entered the right password but can still access a PDF directly, or an embedded spreadsheet visible to anyone who guesses the media URL.
| What it covers | What it does NOT cover |
|---|---|
| The page or post body content | Embedded PDFs, images, and files — their direct URLs remain accessible |
| Any text, shortcodes, or blocks on that specific page | Other pages on the same site |
| Access for unauthenticated visitors | Role-based access (logged-in WordPress users can bypass with the right roles) |
| A single shared password for that page | Multiple passwords (one per client, per team, per region) |
| Content hidden from casual browsing | The page URL and title in Google search results |
File access gap in practice. A Cape Town architectural firm password-protects a page that contains a link to a 40 MB DWG drawing stored in the WordPress Media Library. The page is gated — but the media file URL (yourdomain.co.za/wp-content/uploads/2026/drawing.dwg) is not. Anyone with that direct URL, whether shared in an email or discovered via a search, can download the file without a password. The fix: host sensitive files outside the WordPress media library (a private Dropbox folder, Google Drive with restricted sharing, or an S3 bucket with signed URLs) and link to them from the protected page.
Caching bypass. If you run a caching plugin — WP Rocket, W3 Total Cache, or a host-level cache — and a visitor successfully unlocks a page, the plugin may save a static copy of the unlocked page. The next visitor who reaches that URL could receive the cached, already-unlocked version without entering a password. Most caching plugins can be configured to exclude password-protected URLs or to key caches to the authentication cookie, but this is not their default setting. Check your caching plugin's documentation and test the behaviour manually after configuring protection.
Which Protection Method Fits Your Situation?
The right protection approach changes depending on how many people need access, whether the audience changes often, and how sensitive the content is. This table maps four common South African business scenarios to the correct tool — without requiring you to evaluate every plugin on the market.
| Scenario | Method | Why this one | Where it breaks |
|---|---|---|---|
| Sharing a single quote or proposal with one client | Native WordPress page protection | One password, one audience — no plugin needed | Client forwards the password; anyone can access it |
| Wholesale price list seen by multiple trade buyers | PPWP plugin (multiple passwords per page) | Issue each buyer a unique code; revoke individuals without changing the URL | Individual codes still share the same page content |
| Staff-only intranet page for a team of five or more | WordPress membership or user-roles plugin | Ties access to WordPress user accounts — no password to share or forget | Requires team members to have WordPress logins |
| Entire staging or pre-launch site | "Password Protected" site-wide plugin | One master password covers every page — no per-page configuration | All stakeholders share one code; no per-user tracking |
The decision in one line: if you need one password for one page shared with a small, trusted audience, use the native WordPress tool. If you need to restrict WordPress page access by individual, role, or category, install a plugin — both leading options listed below are free for most SA business use cases.
Not sure which setup matches your workflow?
Tell us what you are trying to protect and who the audience is — we will give you a clear, no-obligation recommendation within 24 hours.
Get a free consultationWhen to Install a Plugin for WordPress Password Protection
The quickest way to password protect page WordPress content is the built-in visibility setting described above. When that is not enough — multiple passwords, category gates, expiring codes — two free plugins from the WordPress directory cover the gap, and both have been maintained continuously through 2026.
Password Protected (wpexperts.io) — best for site-wide or category protection
With over 300,000 active installations and last updated in version 2.8.4, this plugin adds a site-wide password gate, category-level protection, multiple passwords with expiration and usage limits, IP address whitelisting, reCAPTCHA, hCaptcha, and Cloudflare Turnstile support, and activity logging (IP addresses, dates, times, and login statuses). If you need to lock an entire staging environment or a WooCommerce product category (for example, a trade-only catalogue visible only to registered resellers), this is the plugin to reach for. The free version handles most SA small-business scenarios without requiring a paid upgrade.
Install it at: wordpress.org/plugins/password-protected/
PPWP — Password Protect Pages — best for per-page multi-password access
With over 30,000 active installations, last updated on 1 October 2026, and rated 4.7 out of 5 across 270 reviews, PPWP extends the native WordPress password model to support multiple unique passwords per page or post. When you need to password protect WordPress post types, page templates, or category archives with individual codes per buyer or team member, PPWP handles this from its free version.
It also adds Google reCAPTCHA v2 and v3, AJAX-based unlocking (the form submits without a full page reload), cookie expiration controls, and WPML/Polylang multilingual support — useful for bilingual South African sites serving both English and Afrikaans audiences. The partial content protection shortcode lets you lock specific blocks within an otherwise public page, rather than gating the entire page.
Install it at: wordpress.org/plugins/password-protect-page/
A note on POPIA. Whether a password-gated page triggers POPIA obligations depends on what personal information is collected during or after access. POPIA's definition of "processing" is broad — server logs, analytics cookies, and IP address records generated by any page visit, including a gated one, can fall within its scope. A login form or registration form that collects names, email addresses, or phone numbers adds an obvious processing layer, but even background systems collect data. This article cannot determine your legal position. Speak to your Information Officer before treating a password gate as a compliance decision.
SEO and Indexing After You Lock a Page
A WordPress password protect page setup keeps visitors out but does not automatically keep Google out. Understanding this distinction matters if the content is genuinely sensitive — a confidential proposal, an unreleased product page, or internal pricing — because an indexed page title can leak context even when the body is hidden.
Google can crawl the URL of a password-protected page and index its title. It cannot read the body content because it cannot authenticate. This means your page may appear in Google with the title "Protected: Q3 Pricing — Trade Clients", giving away more information than intended.
To fully exclude a password-protected page from search results, you need two steps:
- Add a noindex tag. In your SEO plugin, open the page's SEO settings and set it to "noindex". This instructs search engines not to include the page in their results. WordPress's native protection provides no option for this — the noindex setting is a separate control in your SEO plugin.
- Exclude it from your XML sitemap. Most SEO plugin documentation recommends a separate sitemap control — noindex alone does not remove a URL from an existing sitemap entry. Check your SEO plugin's sitemap settings and exclude the protected page so search engines do not continue to discover it through the sitemap after the noindex directive takes effect.
When to skip the noindex step: if the page is a locked version of something that should exist publicly (for example, a password-protected preview of a publicly-launching product page), leave it indexable. Only add noindex when the content itself is private and should never appear in search results under any circumstances.
Why South African Businesses Choose Growth Pulse Media
Growth Pulse Media builds and manages websites for South African businesses that need more than a locked page — client portals, gated trade catalogues, member-only content areas, and custom access structures that the native WordPress tool cannot handle on its own. Our web design service covers the full stack: architecture planning, plugin selection and configuration, user role design, and the technical details that generic tutorials skip over (caching conflicts, file protection gaps, POPIA-compliant registration flows).
All work is executed in-house by senior team members. We maintain a limited client load to give every project the attention it needs — not a handoff to a junior after sign-off. If your business is sharing sensitive commercial documents with clients, distributors, or staff through WordPress and you want a setup that is robust rather than just functional, start with a free consultation — we will get back to you within 24 hours.
Ready to move past a single locked page?
Send us a brief on your access control requirements — trade portal, client files, staff intranet — and we will audit your current setup and propose a fit-for-purpose structure.
Request a free site auditWho This Is NOT For
Businesses handling highly sensitive regulated data. If the content behind your WordPress page includes personal health records, financial account data, or legally privileged information, a WordPress page password is not an appropriate security control. This level of sensitivity requires server-level authentication, a purpose-built secure portal, and legal review — not a WordPress visibility toggle.
Teams that need individual, auditable access logs. The native WordPress password method has no activity log. You cannot see who accessed a page, when, or how many times. If you need an audit trail — for compliance, for billing, or for accountability — you need a membership plugin with logging, or a dedicated document-sharing platform with version history.
Sites with heavy caching and no technical resource to configure exclusions. If your hosting environment runs aggressive server-side caching (common on managed WordPress hosts like Kinsta, WP Engine, or Afrihost's managed plans) and you do not have someone who can configure cache exclusion rules, the caching bypass risk described above is real. In this case, use a plugin that explicitly handles its own cookie-based cache interaction, or test the behaviour with your host's support team before relying on native protection for sensitive content.
Anyone who needs to revoke access for individual users. A single shared password cannot be revoked for one person without changing it for everyone. If a former employee, a lost client relationship, or a partner dispute means you need to cut one person's access without affecting others, the native method has no path to that outcome. Individual access control requires WordPress user accounts and role-based permissions — see the WordPress user roles and permissions guide for how to structure this.
Frequently Asked Questions
How do I password protect a WordPress page without a plugin?
Open the page in the Block Editor, click the visibility control in the Summary panel (it shows "Public" by default), select Password Protected, enter a password, and click Publish or Update. WordPress stores the password as a hash and presents a prompt to every visitor. No plugin is required. The native method supports one password per page and does not protect embedded media files.
Does WordPress password protection hide the page from Google?
No. Google can crawl and index the page URL and title even when content is gated by a password. To exclude the page from search results, set it to noindex in your SEO plugin settings and remove it from your XML sitemap. Password protection alone does not remove a page from Google's index.
Can I password protect multiple pages with different passwords in WordPress?
Yes, but not with the native tool. WordPress's built-in method gives each page its own single password — you can use different passwords on different pages, but each page only supports one password at a time. To issue multiple unique passwords for a single page (for example, one per trade buyer), you need a plugin such as PPWP, which supports multiple passwords per page from its free version.
How long does a WordPress page password stay active in a visitor's browser?
WordPress sets a browser cookie lasting approximately 10 days when a visitor correctly enters the password. During that window, the visitor can return to the page without re-entering the password. After the cookie expires or is cleared, the password prompt reappears. The cookie duration is not adjustable in the native WordPress settings; a plugin is required to change it.
Does WordPress password protection work with WooCommerce product pages?
The native WordPress visibility setting applies to WooCommerce product pages in the same way it applies to standard posts and pages. However, WooCommerce's add-to-cart functionality and product feeds may expose product data through other routes (REST API, product sitemaps) even when the front-end page is password-gated. For genuine trade-only or member-only WooCommerce catalogues, a purpose-built membership or wholesale plugin is a more reliable choice.
Is password-protecting a WordPress page enough for POPIA compliance?
Whether a password-gated page triggers POPIA obligations depends on what personal information is collected during or after access. POPIA's definition of "processing" is broad — server logs, analytics, and IP address records generated by page visits can fall within scope, even before a visitor enters a password. Restricting content visibility is a security measure, not a POPIA compliance mechanism on its own. Speak to your Information Officer before treating a password gate as a compliance decision.
Need a WordPress Access Setup That Actually Works?
Growth Pulse Media configures WordPress sites for South African businesses that need structured access control — trade portals, client file areas, staff intranets — built correctly from the start, not patched together as problems appear. All work is done in-house by senior team members who have configured these setups across Elementor, Gutenberg, and WooCommerce environments. No obligation — we will get back to you within 24 hours.
Get a free consultation