Yes—you can password protect one WordPress page without a plugin. In the page editor, open Status & Visibility (called Visibility in the Classic Editor), choose Password Protected, enter a password, and select Publish or Update. WordPress then shows visitors the page title and a password form instead of the page content until they submit the correct password.
Antihost offers managed WordPress hosting with free migration, one-click staging and a 14-day free trial.
The built-in setting is designed for one shared secret and protects the page’s rendered content. It does not automatically secure directly linked images or uploaded files, and it does not provide features such as multiple passwords, expiring access, partial-page rules, IP restrictions, or CAPTCHA. This guide explains the exact editor steps, the difference between Private and Password Protected, WordPress’s 20-character limit and cookie behavior, when a plugin is justified, and how to avoid exposing protected media.
As an Amazon Associate I earn from qualifying purchases.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →What WordPress page password protection actually does
A WordPress page is public by default. Changing its visibility to Password Protected keeps the page content behind a shared password while leaving the page’s title visible to a visitor. The visitor receives a password prompt; only after the correct password is submitted does WordPress render the page content.
This is different from encrypting every URL associated with the page. The setting controls access to the WordPress page response. A file, image, or other upload linked from that page can still be reachable directly if someone has its URL. Treat the page password as a content gate, not as a complete file-delivery security system.
How to password protect a page in the Block Editor
These steps use the current WordPress block-editor terminology. You need permission to edit and publish (or update) the page.
- Open the page. In the WordPress dashboard, go to Pages, choose All Pages, and select the page you want to protect. You can also create a new page and apply the setting before publishing.
- Open the visibility controls. In the editor’s settings sidebar, locate Status & Visibility. If the sidebar is hidden, use the editor’s settings button to display it.
- Change the visibility. Select the current visibility value, normally Public, and choose Password Protected. WordPress reveals a password field when this option is selected.
- Enter the shared password. Type the password in the field. Core WordPress limits this password to 20 characters, so plan a memorable value that fits that limit.
- Save the change. Select Publish for a new page or Update for an existing page. The setting is not active for visitors until the page is saved.
- Verify the visitor view. Open the page in a separate browser session or a private window. You should see the page title and password form rather than the page body. Enter the password to confirm that the content appears.
Anyone who knows the shared password can pass this prompt. WordPress does not turn the page into an account-based area, so do not use this mode when each reader needs an individually managed identity or permission level.
How to password protect a page in the Classic Editor
The Classic Editor uses the same three visibility choices but places them in the publishing box.
- Open Pages and edit the page.
- Find the Publish panel and select the Edit link beside Visibility.
- Choose Password Protected.
- Enter a password, then select OK (or the equivalent confirmation control shown by your editor).
- Select Publish for a new page or Update for an existing page.
- Check the public URL in a separate browser session to make sure the prompt appears.
Classic Editor pages can also be set to Public or Private. The selected option is shown in the Publish panel after you save.
What visitors see after you enable the setting
A protected page does not display its body until the visitor submits the correct password. The page title remains visible, which can reveal the subject of a private announcement or preview. If the title itself is sensitive, use a less revealing title or choose account-based private access instead.
After a successful entry, WordPress stores the password in a browser cookie. The reader normally does not have to enter it again when revisiting that same page in that browser. This convenience is browser-specific: deleting cookies, switching browsers or devices, or using a private window can cause the prompt to appear again.
WordPress tracks one password at a time in this built-in flow. If a visitor moves between pages protected by different passwords, the browser may need the appropriate password again. This makes the core feature a poor fit for a large collection of pages that each require separate credentials.
Password Protected versus Private
Both options remove ordinary public access, but they use different access models.
| Visibility choice | Who can open the page | Best use |
|---|---|---|
| Password Protected | Anyone who has the shared password and submits it at the prompt | A client preview, a small-group announcement, or a page shared with people who can safely use one secret |
| Private | Logged-in WordPress users with the required role; WordPress documentation describes private content as visible only to users with the Administrator or Editor role | Role-based internal content where access should follow WordPress accounts rather than a shared secret |
| Public | Anyone who can reach the page | Normal published content |
Choose Password Protected when distributing one secret is acceptable. Choose Private when removing a person’s WordPress role should immediately remove access, or when you need account-level control. A private page is not a substitute for creating the right user account and role; the reader must be logged in.
Core limits you should plan around
The 20-character password limit
WordPress’s built-in page password is limited to 20 characters. A password manager can generate a strong value, but it must be shortened to fit this documented limit. Store the final value in a secure password manager and share it through a channel appropriate to the sensitivity of the page.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →One shared credential
Core visibility supplies one password for the page. It does not provide separate passwords for different people, a list of allowed email addresses, or per-user audit trails. If the secret is forwarded, every recipient who has it receives the same level of access.
Cookie-based reuse
The browser cookie avoids repeated prompts on the same page, but it also means that a shared computer or browser profile can retain access after the original reader leaves. Ask users to sign out of a shared profile or clear the site’s cookies when that matters.
Listing and archive exposure
WordPress documentation notes that password-protected entries can still appear in some non-single views unless the site is customized to exclude them. A developer can use a pre_get_posts and posts_where approach to remove protected posts or pages from selected queries. The exact behavior depends on the theme and query setup, so test the customization on a staging copy before deploying it. Hiding a title from a listing does not replace protecting the page itself.
Can you password protect only part of a page?
The built-in page-visibility control applies to the page as a whole. It does not provide a core setting that wraps one paragraph, block, download button, or section in a separate password prompt while leaving the rest public.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchIf only part of the page needs a gate, use a solution that explicitly supports partial-content protection. Before enabling one, decide whether the public portion should remain visible, whether the protected section contains downloads, and whether every page builder used on the site is supported. A partial-content feature can hide the HTML section while leaving a directly linked file exposed if the file itself is not protected.
When a plugin is justified
A plugin becomes useful when the requirement goes beyond one page and one shared password. Two WordPress.org listings describe different feature sets:
| Requirement | Built-in WordPress visibility | Password Protected plugin listing | PPWP – Password Protect Pages listing |
|---|---|---|---|
| Protect one page with a shared password | Yes | Yes | Yes |
| Sitewide protection | No single built-in switch for this workflow | Listed | Listed |
| Partial-content protection | No | Listed | Listed |
| Multiple passwords | No | Not listed among the cited features | Listed |
| Role-based allowlists | Private visibility uses WordPress roles | Listed | Listed as whitelisted roles |
| Timed access or usage limits | No | Not listed among the cited features | Listed |
| IP rules or bypass links | No | Listed | Not listed among the cited features |
| CAPTCHA or attempt monitoring | No | Listed | Not listed among the cited features |
| WooCommerce protection | No | Listed | Not listed among the cited features |
| Page-builder integrations | Works with the editor in WordPress core | Not listed among the cited features | Integrations with builders such as Elementor and Divi are listed |
| wp-admin protection | No | Listed | Not listed among the cited features |
Those listings describe capabilities, not a guarantee that every feature behaves identically on your installation. Check the plugin’s current compatibility, support policy, pricing, and update history before activating it, and test the protected views with your theme, caching configuration, and page builder.
Use core WordPress when the requirement is simple
For a single page, one shared password, and no special expiry or role rules, the editor setting avoids an additional software dependency. Fewer moving parts also make it easier to troubleshoot: the visibility value, the password, and the page’s published state are the key controls.
Use a plugin for rules that core does not have
Sitewide gates, category or WooCommerce rules, multiple passwords, timed access, usage limits, IP restrictions, CAPTCHA, bypass links, attempt monitoring, and partial-content prompts are all reasons to evaluate a plugin. Make a written list of the required rules first; otherwise, it is easy to install a plugin that solves one requirement while leaving another exposed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Page passwords do not automatically protect media files
Do not promise that a password-protected page secures every image, PDF, video, or other upload linked from it. The PPWP WordPress.org listing gives this explicit warning: “This plugin does not protect images or uploaded files so if you attach the media files to the protected pages or posts, they are still accessible to anyone with the link.” The same security principle applies when evaluating core page passwords: a person who obtains a direct media URL may be able to request that file without completing the page prompt.
Best Value
For sensitive downloads, use separate access control around the storage or delivery layer, or use expiring delivery URLs. Test with the direct file URL in a fresh browser session rather than assuming that hiding a download link is equivalent to securing the file.
Troubleshooting checklist
The password form is not appearing
- Reopen the page editor and confirm that Password Protected, not Public or Private, is selected.
- Confirm that you selected Publish or Update after entering the password.
- Open the page in a private browser window or another browser so an existing cookie does not hide the prompt.
- Verify that you are testing the exact page URL whose visibility you changed.
The correct password keeps being rejected
- Enter the saved value exactly as configured; the 20-character limit means a copied value may have been shortened during setup.
- Check whether you are moving between pages that use different passwords. WordPress can require the appropriate password again because it tracks one password at a time.
- Clear the site cookie and retry if the browser has retained an earlier credential.
The page title appears in a menu or archive
Password protection controls access to the page content, not every place a title may be queried. Review menus, search results, and archive views. If protected entries must be excluded from non-single queries, have a developer implement and test the documented pre_get_posts/posts_where customization for the site’s theme and query structure.
Free tools Windows power users keep installed
One-click scans. No signup required.
A linked file opens without a password
That is expected when the file is independently reachable. Move sensitive files behind access-controlled storage or an expiring delivery mechanism; do not rely on the page prompt alone.
A practical decision guide
- One page, one shared secret: use the built-in Password Protected visibility setting.
- Internal staff content tied to WordPress accounts: use Private and assign the appropriate logged-in roles.
- Only one section of a public page: choose a solution that explicitly supports partial-content protection and test its builder integration.
- Several pages with different credentials: evaluate multiple-password support; core’s one-password tracking is a limitation.
- Expiry, usage limits, IP rules, CAPTCHA, bypass links, or monitoring: use a plugin whose current feature list includes the exact rule.
- Sensitive downloads: add separate file or delivery protection, regardless of which page gate you choose.
For a straightforward client preview or small-group announcement, the editor’s built-in setting is usually the shortest path. For account-driven access, use private visibility. For granular policies or partial sections, select software that explicitly supplies those controls and verify that media files are protected independently.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
