WordPress can already password protect a single post or page with no plugin at all, from its visibility setting. A plugin earns its place when you need more: the whole site behind one password, several passwords, access by user role, protected PDFs or protected pages hidden from listings. Ten free plugins follow, in no particular order.
Most people go looking for a plugin before they've checked what WordPress does on its own, and for one private page that's a wasted install. The plugins below are for the jobs core can't do, and the guide further down sorts them by job rather than by size.
They're listed alphabetically, and each description is the plugin's own from the WordPress.org plugin directory. If what you need to lock is a document rather than a page, my guide on how to password protect a Word document covers that side.
Password protection plugins compared
Every plugin here is a free plugin in the WordPress.org plugin directory, as of Oct 2026, which is why the free plan column says Yes. Some makers sell extra features on their own sites, so check the plugin page for anything you'll rely on.
| Tool | Type | Good for | Free plan |
|---|---|---|---|
| Customize Private and Protected | WordPress plugin | Changes the Protected prefix and the look of the password form | Yes |
| Hidden Password Protected Pages | WordPress plugin | Hides password protected pages from archives and listings | Yes |
| Passster | WordPress plugin | Hides part of a page or whole pages behind a password | Yes |
| Password Protected | WordPress plugin | Locks the site, pages, posts or products with one or more passwords | Yes |
| Password Protected Site and Store | WordPress plugin | Restricts access to the site and WooCommerce store by password | Yes |
| PDF Password Protect | WordPress plugin | Puts a password on PDF files in the media library | Yes |
| PPWP | WordPress plugin | Protects pages and posts by user role or with multiple passwords | Yes |
| Simple Password Protect | WordPress plugin | Puts one password on the whole site with links to legal pages | Yes |
| Smart Password Protect | WordPress plugin | Protects the site and creates temporary login links without passwords | Yes |
| WPEPP | WordPress plugin | Combines password protection with login limits and country restrictions | Yes |
What each password plugin is for
Customize Private and Protected
Best for: Changing or removing the Protected and Private title prefix, and styling the password form's text, button and colours, block themes included.
Hidden Password Protected Pages
Best for: Keeping password protected posts and pages out of your archives and listings, so visitors don't see links to pages they can't open.
Passster
Best for: Putting a password on part of a page, or on whole pages and posts, when only one section needs to stay private.
Password Protected
Best for: Locking a whole site, or chosen pages, posts, categories and WooCommerce products, with one password or several from a single plugin.
Password Protected Site and Store
Best for: WooCommerce shops that want both the site and the store restricted by password, so only people with the password can browse products.
PDF Password Protect
Best for: PDF files in your media library that need a password, since core WordPress protects posts and pages rather than files.
PPWP
Best for: Giving different access by user role or with multiple passwords, and protecting the entire site with a single password when you need it.
Simple Password Protect
Best for: One password on the whole site, with modal links to your legal pages so visitors can still read them, which the listing says is GDPR-compliant.
Smart Password Protect
Best for: Developers and maintenance visits: it protects the whole site and creates temporary login links that work without a password.
WPEPP
Best for: Pairing password protection with login limits, AI crawler blocking, country restrictions and a live-preview login customizer in one security plugin.
What WordPress does before you install anything
The WordPress documentation on content visibility sets this out. You can set each post and page to public, private or password protected, one at a time. The same page says the entire blog can be made private and password protected through the use of WordPress plugins.
So core covers a single page, free, with nothing extra to update. Open the page in the editor, change its visibility, type a password and share it with the people who need it. If that's the whole job, you can stop there.
Want AI doing the heavy lifting in your marketing?
I build the systems that handle the boring 80 percent, so you get your week back. Done properly, with the human kept in.
Match the plugin to the lock you need
- The whole site behind one password: for a site that isn't ready yet, a client preview or a private community. Several plugins here do only this.
- Several passwords or user roles: so different people get different access, and you can change one password without telling everyone.
- Part of a page: to put one section, such as a download, behind a password while the rest of the page stays public.
- PDF files: core protects posts and pages, not the files in your media library, so a PDF needs its own protection.
- Hidden listings and a tidier form: to keep protected pages out of your archives, or to change the Protected prefix and the look of the password form.
- Temporary access: login links that work without a password, for a developer or a maintenance visit.
You may also want my WordPress slider plugins roundup.
One giant and a long tail
The install gap on this list is wide. Password Protected has 300,000+ active installs, as of Oct 2026. The next largest, PPWP, has 30,000+, and most of the rest have a few thousand installs or a few hundred.
Small plugins aren't a problem in themselves, and three of them show 100/100. Those scores come from 1 or 2 ratings each, though, so they tell you very little. A plugin that guards private content should be one you can see is looked after, so check the last updated date and the support threads before you trust it with anything sensitive.
Also worth knowing about: my WordPress donation plugins roundup.
What a shared password won't do
A shared password is a light lock. Anyone who has it can pass it on, and it doesn't tell you who visited. For a client preview or a staging site that's usually fine. For anything personal or confidential, user accounts and roles are the stronger option, and your hosting setup matters too. My guide on where your host's security stops on WordPress covers the part that's on you.
Do you make a WordPress password protection plugin? Tool makers can ask to be considered for a featured place on this list.
My plain advice on password protecting WordPress
Use the built-in visibility setting for a single page. Install a plugin only when the job is bigger: the whole site, several passwords, user roles, PDFs or hidden listings. And choose one plugin for the job, not three, because each extra one is something else to keep updated.
Want your tool on this list? Featured spots and reviews here are paid partnerships. Here's how to partner with me.
Frequently asked questions
Can I password protect a WordPress page without a plugin?
Yes. WordPress lets you set any single post or page to password protected from its visibility setting, according to the WordPress documentation.
How do I password protect my whole WordPress site?
You need a plugin. The WordPress documentation says the entire blog can be made private and password protected through plugins, and several here do that job.
Can I give different people different passwords?
Yes, with a plugin that supports multiple passwords or user roles. Core sets protection one post or page at a time.
Does WordPress password protect PDF files?
Core protects posts and pages, not the files in your media library. A PDF needs a plugin built for that job.
Are WordPress password protection plugins free?
All ten here are free plugins in the WordPress.org plugin directory, as of Oct 2026. Some makers sell extra features on their own sites, so check each plugin's page.
