Recommended Free Tools
iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
Yes. WordPress can protect an individual page with its built-in editor: set Status & Visibility (called Visibility in the Classic Editor) to Password Protected, enter a password of up to 20 characters, then publish or update the page.
What WordPress password protection actually does
A password-protected page is still a normal WordPress page, but its content is withheld until a visitor submits the password. After you publish the setting, WordPress displays the page title and a password form instead of the page body. Anyone who knows the shared password can pass that form; the visitor does not need a WordPress account.
Free tools Windows power users keep installed
One-click scans. No signup required.
This is useful for a client preview, a temporary announcement, or information intended for a small group that can share one secret. It is not the same access model as requiring each reader to sign in with an individual WordPress account.
Protect a page in the Block Editor
The block editor includes password protection in core WordPress, so a plugin is unnecessary for one page and one shared password.
#1 Best Overall
- Sign in to WordPress and open Pages in the dashboard.
- Open an existing page or select Add New Page.
- In the editor sidebar, open the page settings and expand Status & Visibility.
- Next to the visibility setting, select Password Protected. WordPress also offers Public and Private.
- Enter the password in the field that appears. Core WordPress limits this password to 20 characters.
- Select Publish for a new page or Update for an existing one.
Open the published page in a separate browser window, preferably one that is not signed in to the site, and submit the password. You should see the page title and password prompt before entering the correct value, followed by the page content after successful submission.
Changing an existing page
For a page that is already public, repeat the same path, change the visibility to Password Protected, enter the password, and click Update. To remove the prompt, return to Status & Visibility, choose Public, and update the page.
Protect a page in the Classic Editor
The Classic Editor uses the same three visibility choices but places them in the Publish panel.
- Open the page for editing.
- In the Publish panel, find Visibility and click its Edit link.
- Select Password Protected.
- Type the password in the field that appears.
- Click Publish or Update.
Visitors receive the same password form and the same shared-secret access model as they do with the block editor.
Password Protected versus Private
These settings answer different questions: should access be granted by possession of one shared password, or by a reader’s WordPress account and role?
| Setting | Who can view the page | Credential model | Best fit |
|---|---|---|---|
| Password Protected | Anyone who submits the page password | One shared secret entered at a form | Client previews, small-group sharing, or a private announcement |
| Private | Logged-in users with the required WordPress role | Individual WordPress accounts and role permissions | Content for site staff or other authenticated users |
| Public | Visitors without an access check | None | Ordinary published content |
WordPress documentation describes Private content as visible only to site users with the Administrator or Editor role. Choose Private when access must follow accounts and roles; choose Password Protected when a common password is acceptable.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What visitors see after you enable it
The protected page does not become invisible in every context automatically. A visitor who reaches the page sees its title and a password prompt, while the page content remains unavailable until the submitted password is accepted.
WordPress stores the password in a browser cookie. A reader who has already entered the password therefore does not normally need to enter it again every time they revisit the same page in that browser. This convenience belongs to that browser session and its cookie; it is not a separate user account or a record that identifies each person.
Moving between pages with different passwords
WordPress tracks one password at a time. If a reader moves between protected pages that use different passwords, WordPress may require the appropriate password again when the active password does not match the page being opened. For a group, using one shared password for all pages avoids that switching friction.
Can you protect only part of a page?
The built-in page setting protects the page as a whole. It does not provide a core editor control for wrapping one paragraph, block, download link, or section in a separate password prompt while leaving the rest public.
Partial-content protection is therefore a plugin requirement. If only a callout, lesson, pricing section, or other fragment should be restricted, use a plugin that explicitly supports partial-content rules and test the result on the exact editor or page-builder layout you use. Do not assume that changing the page’s normal visibility will create a block-level lock.
Core behavior and limits to plan for
Twenty-character maximum
The built-in password field accepts a maximum of 20 characters. If your organization’s password policy requires a longer passphrase, core page protection cannot meet that requirement by itself. A plugin may offer a different credential system, but verify its documented limits before choosing it.
One shared password is not per-person access
Everyone who receives the password uses the same credential. WordPress core does not provide separate passwords, usage quotas, expiry dates, IP restrictions, or an audit trail for a protected page. Those are requirements for an extended access-control system rather than the single-page core setting.
Protected content can appear in site views
WordPress’s official guidance notes that password-protected entries may still be exposed in some non-single views, such as lists or archives, unless they are excluded deliberately. A developer can customize the site’s queries with the pre_get_posts and posts_where approach described in the official guidance. Because themes and query setups differ, test that customization on the actual site before relying on it; it is not a checkbox in the page editor.
Excluding an entry from a listing is separate from protecting the page itself. Check both the page URL and the archive, search, category, or other views through which visitors might discover it.
Rank #4
Do page passwords protect images and uploaded files?
No. A page password does not automatically secure every file linked from that page. The PPWP – Password Protect Pages listing specifically warns: “This plugin does not protect images or uploaded files so if you attach the media files to the protected pages or posts, they are still accessible to anyone with the link.” The warning applies to the security assumption readers commonly make: knowing the page password is not the same as controlling direct access to a media URL.
If a download is sensitive, give it separate protection through access-controlled storage or expiring delivery URLs. Do not treat an unprotected image, PDF, video, or other upload as secured merely because the page that links to it displays a password form.
When a plugin is justified
Core protection is the simplest choice when one page needs one shared password. A plugin becomes reasonable when the access rules or protected scope extend beyond that model.
| Requirement | Built-in page setting | Plugin-oriented approach |
|---|---|---|
| Scope | One complete page or post at a time | Sitewide, selected pages or posts, categories, WooCommerce content, or partial sections |
| Credentials | One shared password per protected item | Multiple passwords, role-based exceptions, or other credential rules, depending on the plugin |
| Access conditions | No documented expiry, usage limit, IP rule, CAPTCHA, or bypass link | Those controls are listed by some plugins, including timed access, usage limits, IP rules, CAPTCHA, and bypass links |
| Builder support | Uses WordPress’s page visibility control | Some plugins list integrations with builders such as Elementor and Divi |
| Monitoring | No built-in attempt-monitoring feature | Some plugins list monitoring of password attempts |
| Media files | Does not automatically secure directly linked uploads | Check the plugin’s own media-file warning and use separate file access controls when needed |
| Maintenance | Part of WordPress core | Requires compatibility, update, support, and pricing checks for the specific plugin and WordPress version |
Sitewide and advanced rules
The plugin named Password Protected lists sitewide protection as well as page, post, category, WooCommerce, wp-admin, partial-content, role, IP, bypass-link, CAPTCHA, and attempt-monitoring features. Those options address requirements that the core visibility menu does not expose.
Multiple passwords and timed access
PPWP – Password Protect Pages lists multiple passwords, sitewide and partial-content protection, whitelisted roles, timed access, usage limits, and integrations with Elementor and Divi. Select such a tool only after confirming that its current version supports your editor, theme, and other plugins.
Best Value
A practical decision checklist
- Choose Password Protected if one shared secret is sufficient and the entire page should be restricted.
- Choose Private if every reader should sign in and access should follow WordPress roles.
- Use a plugin if you need multiple passwords, partial-content rules, sitewide coverage, timed or usage-limited access, IP conditions, CAPTCHA, bypass links, attempt monitoring, or listed WooCommerce and builder integrations.
- Use separate file controls if the page links to sensitive uploads.
- Ask a developer to customize queries when protected entries must be removed from non-single site views, and test the result in the site’s actual theme and query structure.
Testing and troubleshooting
The password field is missing in the editor
- Confirm that you are editing a Page rather than looking at the public front end.
- In the block editor, open Status & Visibility; in the Classic Editor, open the Publish panel and click Edit beside Visibility.
- Select Password Protected. The password field appears only after that choice is selected.
- Save with Publish or Update.
The page still looks public
- Open the page URL in a browser window that is not already carrying a successful password cookie.
- Check the page’s saved visibility again; selecting a setting without publishing or updating does not change the live page.
- Confirm that you are testing the protected page URL, not a separate archive or listing view.
A visitor is prompted repeatedly
WordPress relies on a browser cookie to remember a successful password entry. A reader using another browser, a different device, or a browser without that cookie should expect another prompt. Moving among pages protected with different passwords can also require the relevant password again.
A protected download still opens
That behavior is expected when the file itself has a directly reachable URL. Apply separate storage or delivery controls to the file; changing the page visibility does not retroactively secure the upload.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Sharing the password responsibly
Use Password Protected only when a shared secret is an acceptable boundary. Send the password to the intended group through a channel appropriate for that group, avoid placing it in the page URL or page copy, and remember that every recipient can share it onward. When people must be added or removed individually, the Private setting and WordPress roles provide a better fit than repeatedly redistributing one password.
For a client preview, test the exact visitor experience before sending the link: open a clean browser session, verify that the title and prompt appear, enter the password, follow every important link, and check whether any linked files require their own protection.
Bottom line
For one WordPress page, use the editor’s Password Protected visibility option, enter a password no longer than 20 characters, and publish or update. Use Private for role-based account access. Move to a plugin only for broader scope or advanced rules, and protect sensitive media files separately because a page password alone does not secure direct file links.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →
