How to Password Protect a WordPress Page Without Plugins

Password-protect a page in the block editor

1. In WP Admin, go to Pages → All Pages and edit the page you want to protect.
2. Open the Settings sidebar using the button in the upper-right corner if it is hidden, then select the Page tab.
3. Find Status in the page settings. In older editor layouts, this may appear as Visibility. Choose Password protected.
4. Enter the password you want to share with visitors.
5. Click Update for an existing page or Publish for a new page to save the change.

The same feature works for posts: open the post under Posts → All Posts and use its Post settings. A separate password can be set for each page or post.

Test the password prompt

1. Open the page's public URL in a private or incognito browser window where you are not signed in to WordPress.
2. Confirm that WordPress displays a password form instead of the page content.
3. Enter the password and confirm the content becomes visible.

Testing while signed in as an administrator or editor can give a misleading result because authorized users may be able to view protected content without entering its password. WordPress also remembers a successful password entry in a browser cookie, so use a fresh private window when testing again.

Change or remove the password

Edit the page, reopen its Status or Visibility setting, and enter a different password. Save the page with Update. To remove the password prompt, switch the setting back to Public and update the page.

Choosing Private is different. Private pages require an authorized WordPress account; password-protected pages can be opened by anyone who has the shared password.

Understand the limitations

• It protects page content, not the entire website. Other public pages remain accessible.
• It does not necessarily hide the page's existence. The title or link may still appear in site navigation or listings, depending on the theme.
• It does not secure uploaded files. Images, PDFs, and other files in the Media Library can still be accessible through their direct URLs, even when linked from a password-protected page.
• It is not individual user access control. Anyone with the shared password can use it, and you cannot revoke access for only one recipient without changing the password for everyone.

Use this built-in setting when you want to share ordinary page content with a small group. For confidential files, client portals, or member-specific access, use a system that protects the files and verifies individual users.

For details, see the official WordPress page and post settings and WordPress content visibility guide.