How to Password Protect a Page or Post on Your Website

Many website platforms have a built-in feature to password protect individual pages and posts, but many site owners don’t realise it’s there until they need it. Whether you’re hiding client work, sharing a draft with a collaborator, or creating a members-only resource without a full membership plugin, setting a password on a single piece of content takes about thirty seconds.

Unlike making a page private — which requires a logged-in account on your site to view — password protection lets anyone with the correct password access the content without registering or logging in. That makes it practical for sharing content selectively without adding users to your site. If you’re still working through the basics of your build, the step-by-step guide to making a website covers everything from choosing a host to going live.

Quick Answer

Open the post or page in your editor and find the visibility or privacy setting — often in a sidebar or settings panel. Choose the password-protected option, enter a password, and save or publish. Visitors will see a password prompt when they access that URL.

On WordPress, this is in the block editor’s Settings panel on the right — click Visibility (Public by default), select Password protected, enter a password, and click Publish or Update.

When to Use Password Protection

A few situations where password-protecting a page or post makes practical sense:

• Sharing a completed page with a client before making it public
• Distributing a lead magnet, guide, or template to a specific group
• Locking older or seasonal content without fully unpublishing it
• Testing a landing page or sales page before launch
• Sharing work-in-progress content with a collaborator or reviewer

Password protection is often built directly into the platform, so no separate plugin or tool is required. For more complex access control — such as restricting content to registered subscribers or paid members — you’d need a dedicated membership tool. For straightforward single-password access, the native feature handles it cleanly. If you want a broader view of your site’s overall security posture, securing your website from the ground up is a useful starting point.

How to Password Protect a Page or Post

Step 1: Open the page or post in your editor

From your site’s dashboard or admin area, find the content you want to protect, and open it in the editor. This works on both pages and standard posts.

On WordPress, go to Pages or Posts, find the content, and click to open it in the editor.

Step 2: Find the visibility setting

Look for the visibility or privacy setting in your editor — often in a sidebar or settings panel. By default, most platforms set new content to fully public.

On WordPress, this is the Settings panel on the right side of the editor screen (click the gear icon in the top-right corner if the panel isn’t visible). Under the Post tab (or Page tab for a page), the Summary section near the top shows the current Visibility status — Public by default.

Step 3: Switch visibility to password-protected

Switch the visibility option to password-protected (sometimes called “restricted” depending on the platform), then enter the password you want to use. Passwords are usually case-sensitive, so note exactly what you enter.

On WordPress, click the word Public next to Visibility. A small panel drops down with three options:

• Public — visible to everyone (default)
• Private — visible only to logged-in editors and administrators on your site
• Password Protected — accessible to anyone who enters the correct password

Select Password protected. A Password field appears below the options — type in your password and click Apply to confirm the selection.

Step 4: Publish or update

Publish a new post, or update an existing one. The password protection takes effect immediately — visitors will see a password prompt instead of the content when they access the URL.

Step 5: Test the password prompt

Open the page or post URL in an incognito or private browser window to bypass any editor session cookies. You should see a message along the lines of “This content is password protected” followed by a password entry field. Enter the password you set to confirm everything is working before sharing the link.

How the Password Cookie Actually Works

It’s worth knowing the actual mechanism here, since a couple of commonly repeated claims about it aren’t quite right. WordPress sets a cookie named wp-postpass_ (with a site-specific hash appended) once a visitor enters the correct password, and that cookie’s default lifetime is 10 days — a real, specific figure defined by WordPress core’s own post_password_expires filter, not an indefinite “remembers for the browser session” arrangement. After 10 days, the visitor will be asked for the password again even if they never closed the browser, and a site can shorten or lengthen that window with the filter if the default doesn’t fit.

It’s also worth being precise about the hashing, especially since WordPress 6.8 changed how it hashes regular user account passwords — switching from the older phpass algorithm to bcrypt. That change is specifically about user login passwords, stored in the wp_users table. Post and page passwords are a separate system entirely, stored in the post_password column of wp_posts, and they continue to use the older phpass-based hashing rather than the new bcrypt path — a genuinely different code path from the one WordPress 6.8 upgraded. In practical terms this doesn’t change what you as a site owner need to do (WordPress handles both transparently), but it’s worth not assuming the 6.8 security upgrade applies here, since it doesn’t.

Practical Tips

Passwords are not automatically sent to anyone — you need to share the password with your intended recipients yourself. There is no notification or delivery mechanism built into most platforms for this feature.

The page title remains visible before visitors enter the password. The title appears above the password prompt, so don’t include anything sensitive in the title itself if the content is meant to be confidential.

The access cookie lasts 10 days by default, not indefinitely and not just “per session.” Once a visitor enters the correct password, they won’t be prompted again until that 10-day window expires — worth knowing if you’re sharing a link meant to stay accessible for a one-off project that runs longer than that.

Multiple pages can share the same password. Set the same password on several pages and anyone with that password can access all of them. This is useful when you want to group a set of resources behind a single access code.

In my experience, using a short memorable phrase — three or four unrelated words strung together — works better than a random string of characters. It’s easier to share verbally or in an email without typos. For situations where you need role-based access control rather than a shared password, user roles and permissions give you much finer control over who can see what.

Common Mistakes

Forgetting to share the password — once you publish the protected post, nothing sends the password to anyone. It’s easy to set protection and forget to communicate the access details to the people who need them.

Using an obvious password — a simple string like “password” or the page title gives almost no security. Anyone with the URL could guess it quickly. Use something non-obvious and unrelated to the content.

Expecting it to hide the page from search engines — password protection does not automatically add a noindex directive. Search engines can still crawl and index the page title and URL. If the page needs to be completely invisible to search engines, add a noindex tag or keep the content as a draft until it’s ready. On WordPress, the official documentation covers content visibility options in more detail.

Assuming password protection uses the same modern hashing as your WordPress login. As covered above, it doesn’t — a separate, older code path handles it, which doesn’t weaken it for its actual purpose (casual selective sharing) but is worth knowing if you were assuming otherwise.

Password Protected vs Private vs Draft

It’s worth understanding the differences between these non-public visibility options:

• Draft — saved but not published; only accessible to logged-in editors and admins in the dashboard or admin area
• Private — published, but only visible to logged-in editors and admins on the frontend
• Password Protected — published and accessible to anyone with the correct password, no account required, with access remembered via a 10-day cookie once entered

Password protection is the only option that lets you share content with someone who does not have an account on your site. That distinction matters when you’re working with clients, contractors, or an audience that shouldn’t need to register just to view a page.

Conclusion

Password protecting a page or post takes less than a minute on most platforms and works straight out of the box. It’s easy to overlook because the setting is tucked inside Visibility rather than being a standalone menu option. Use it for client previews, selective sharing, or any situation where you want to control access without building a full membership system — and remember the access cookie is good for 10 days, not indefinitely, if you’re sharing a link that needs to stay open longer than that. For a broader check of how secure your site actually is, a security audit is a practical next step once the basics are covered.