How to Password Protect a WordPress Page

Updated 5 November 2026 · Standard formula, shown below

Password-protecting a WordPress page limits its content to visitors who know a password, without requiring them to create accounts. WordPress includes this option in its page editor, so you usually do not need a plugin. You’ll need permission to edit the page and access to your WordPress dashboard.

What You’ll Need

A WordPress account with permission to edit the page. If you cannot see the page editor or change its settings, ask an administrator for the required access.
The page you want to protect, either already published or saved as a draft.
A password to share with the intended readers. Choose one that is not used for another account.

Step-by-Step

Sign in to your WordPress dashboard. Open your site’s administration area and sign in with an account that can edit pages.
Open the page. In the dashboard, go to Pages and choose All Pages. Find the page and select Edit. If you are creating a new page, select Add New Page instead.
Find the page’s visibility setting. In the block editor, look in the right-hand settings sidebar. Select the Page tab if the sidebar is showing block settings, then find Status or Summary and the Visibility control. The exact placement and wording can vary with the WordPress version and editor. If the sidebar is hidden, use the settings button near the top-right of the editor.
Choose password protection. Select Visibility, then choose Password protected from the available options. Do not choose Private if you want ordinary visitors to be able to enter a password: private pages are generally visible only to logged-in users with suitable permissions.
Set a password and confirm. Enter the password in the prompt and confirm the change. Use a password that is hard to guess, but practical to share with the people who need access. Avoid including it in the page itself or in a public post.
Save the change. For a published page, select Update. For a new page, select Publish and confirm if WordPress asks. A draft is not available to the public, even if you have selected a visibility option.
Test as a visitor. Open the page in a private or incognito browser window where you are not signed in. Check that WordPress displays a password prompt, enter the password, and confirm the page content appears. Test on a phone as well if readers will use one.
Share access carefully. Send the page link and password only to the intended readers. Share them through a private channel rather than placing both together on a public page or social post.

In the Classic Editor, look for the Publish panel, then select Edit beside Visibility. Choose Password protected, enter the password, and select OK. Finish by selecting Update or Publish, then test the public page.

Common Mistakes

Choosing Private instead of Password protected: Private pages require an appropriate logged-in account; they do not provide a password prompt for general visitors.
Forgetting to update or publish: Changing the setting in the editor does not necessarily make it live until you save the page.
Testing while signed in: Your administrator session can make a page appear accessible without showing what an ordinary visitor sees. Use a private window and sign out.
Sharing a weak or reused password: A short, predictable password may be easy to guess. Do not reuse a personal or account password.
Assuming the page is fully secret: WordPress’s built-in setting controls access to the page through the site, but it is not a substitute for high-security document storage. Avoid putting highly sensitive information there.
Protecting the page but not linked files: A direct media-file URL may still work without the page password, depending on your site setup. Do not assume images or downloads are protected just because they appear on a protected page.

Tips

Use a distinct password and share it separately from the link when practical. Tell readers whether the password is case-sensitive, and send it exactly as entered.
Keep a record of who has access and change the password when the audience changes. Remember that changing it may require sending the new password to all intended readers.
Preview the password form and page on desktop and mobile. Your theme may affect how the prompt looks, but it should still be clear where visitors enter the password.
If only a few people need access, built-in password protection is often simpler than creating accounts. For separate user permissions, an area containing multiple protected pages, or more control over downloads, investigate a reputable access-control solution and test it on a staging site first.
Search engines and caching tools can behave differently across sites. If the content must not be publicly discoverable, test the actual visitor experience and check whether your site’s caching, CDN, or security configuration is compatible with password-protected pages.

Troubleshooting

The password prompt does not appear: Confirm that the page’s visibility is set to Password protected, then select Update. Open the public URL in a private window, not an editor preview. Clear the browser cache and, if your site uses a caching plugin or CDN, clear its cache too.
The password is rejected: Check capitalization, spaces at the beginning or end, and similar-looking characters. Copy the password from the original message or ask the page editor to set and share it again.
The page is still private or unavailable: Reopen the editor and check that you selected password protection rather than Private. Make sure the page is published and that you are testing its published URL.
The prompt appears, but the page will not open afterward: Try another browser or a private window, disable browser extensions temporarily, and clear cookies for the site. If a caching or security plugin is active, ask the site administrator to check its settings and logs.
You cannot find the visibility control: Open the page settings sidebar and select the Page tab. In the Classic Editor, look in the Publish panel. If neither option is available, your user role, editor configuration, or a plugin may limit access; ask an administrator rather than installing an unfamiliar plugin.

Frequently Asked Questions

Can I password-protect a WordPress page without a plugin?
Yes. WordPress has a built-in Password protected visibility setting for pages, so a plugin is not needed for the basic feature.

Do visitors need a WordPress account?
No. Visitors can enter the page password without signing in. This differs from a page set to Private, which generally requires a logged-in account with permission.

Can I protect a page that is already published?
Yes. Edit the page, change its visibility to Password protected, and select Update. Test the live URL afterward.

Can different visitors have different passwords?
The built-in page setting uses one password for that page, not a separate password for each person. Use an appropriate account or access-control system if individual access is necessary.

Does password protection also secure images and downloads?
Not necessarily. Direct links to uploaded files may remain accessible, depending on your hosting and site configuration. Test file URLs separately and use a suitable protected-file solution when needed.

How do I remove the password?
Edit the page, open Visibility, select Public, and save with Update. The page will then be available to visitors without a password.

Method: the standard formula for this calculation, rounded as each result states. See how the calculators work or report an error.