Home / Plugins / Simple Password Protect

Freev1.1.1 · updated Oct 12, 2026 · GPL · no Pro version

Simple Password Protect: one password in front of the whole site

A free WordPress plugin that puts a branded password gate in front of every public page: staging sites, client previews, private blogs, the week before a relaunch. One switch, one shared password, your logo and colors, and visitors stay in for 24 hours.

Download free on wordpress.org How it works ↓

When is one password enough?

WordPress offers two ways to keep people out. The per-post password protects a single post and nothing around it. User accounts protect everything, at the price of registration, roles and password resets for people who only wanted a look.

Between the two sits the case most sites actually have: a staging copy, a relaunch in progress, a client review, a family blog. Everyone allowed in shares one word, nobody needs a profile, and the page they land on should look like the site, not like a fault in the web server.

Hosting-level protection, the browser’s own password prompt, does the job technically and looks exactly like that fault. It cannot carry a logo or a sentence explaining what the visitor is looking at, and it stands in front of everything that calls the site from outside, from uptime monitors to payment webhooks.

This plugin is the middle option. One switch, one password, a page with your logo, your wording and your colors, and a 24-hour cookie so the reviewer types the password once, not on every page.

It is a gate for the front end, not encryption. Content that must stay confidential belongs behind real accounts or off the public web.

This is what it looks like

Demo password: preview

staging.yoursite.com

Unlocked for 24 hours · one cookie, no account

The gate in front of a page. Type preview to open it, a wrong password shakes the field, the legal links open a modal, Lock again closes it. The chips switch the logo shape.

How it works

One switch, one password

Settings, Password Protect: tick Enable password protection for the entire site, set a password, save. From then on every public page shows the gate first: home page, posts, pages, archives, search. The password is stored as a bcrypt hash, the way WordPress stores account passwords since 6.8, never in plain text, with no length limit and every character kept exactly as typed.

Tick the box, set a password, write the two lines visitors read.

Visitors meet a gate, not an error page

A centered card on a plain background: your logo, round, square or plain, a title, a sentence of context, the password field and the button. Below it, optionally, an Admin Login button that leads to wp-admin, and links to your legal notice and privacy policy, which open in a modal without a password because several jurisdictions require them to be reachable at all times. The modal serves those two pages and nothing else. The gate is sent with no-cache headers and a noindex tag, so caches do not store it and search engines do not list it.

White card centered on a blank page with the heading Password Protected, a line asking for the password, a password field, a teal Enter button, an outlined Admin Login button and links to the legal disclosure and privacy policy. — One card, one field, one button. The legal links open in a modal, no password needed.

Make it yours in four fields and four colors

Title and intro text are free text. The logo comes by upload or URL. Background, button, button text and link color have their own pickers. That is the whole design surface, on purpose: enough for a brand, too little to build a landing page.

Plugin settings with a switch to show legal links, selects for the legal disclosure and privacy policy pages, a checkbox for the Admin Login button, and color pickers for background, button and button text. — Pick the two legal pages, decide about the admin button, set the colors.

Getting in, and staying in

A correct password sets a cookie for 24 hours. It holds a token derived from your site salt and the password hash, not the password itself, so a reviewer types it once for an afternoon of pages. After the password, visitors land on the page they asked for, and only ever on an address of your own site. Anyone logged in to WordPress never sees the gate, so editing, previewing and publishing work as before. Change the password and every existing session ends at once, because the token no longer matches.

What it does not do

This is the part most plugin pages leave out.

It is a gate, not a vault. Since 1.1.1 the REST API is closed to visitors without the password too, but uploaded media files are served by the web server directly and stay reachable for anyone with the link. Use it for staging, previews and private blogs, not for confidential material.

Everyone shares one password. No accounts, no roles, no record of who entered. Individual logins are what membership plugins do; this one stays deliberately simpler.

Any logged-in user bypasses it. Not only administrators: whoever has a WordPress login on the site sees the site. Open a private window to check the gate yourself.

It protects the whole front end or nothing. There is no per-page exception and no allow list of IP addresses. One switch, one scope.

It sends nothing anywhere. No external request, no telemetry. The hash lives in your options table, the token in the visitor browser.

It ships in English. Every string is translatable, but no language pack is bundled yet.

Why not the hosting password prompt?

Because the browser prompt is the one thing on your site you cannot design. It has no logo, no sentence, no link to the privacy policy, and on a phone it looks like something went wrong.

It also sits in front of everything that talks to your site from outside: uptime monitors, payment webhooks, the app that posts for you. Each of them needs the credentials or fails quietly.

A gate inside WordPress knows what a page is. It lets logged-in users through, keeps the legal pages reachable, tells search engines to stay away, and leaves cron and admin-ajax alone. The REST API is closed while the gate is up; one filter, spwdprot_protect_rest_api, opens it again for webhooks and apps. And it goes away with one checkbox when launch day comes.

Set up in three steps

Install it

Plugins, Add New, search for Simple Password Protect, install, activate. No account and no license key.

Switch it on

Settings, Password Protect: tick Enable password protection for the entire site, set a password, save. The gate is live for every visitor who is not logged in.

Make it yours

Logo and shape, title and intro text, four colors, the legal pages that open in a modal, the Admin Login button if the team wants it. Turning it off again is the same checkbox; your content is never touched.

Free forever, and why

This plugin is free and stays free. There is no Pro tier and none is planned. It exists because every relaunch and every client preview needs a door, and the alternatives were a browser prompt or a membership plugin.

If it saved you an afternoon, the useful things are a rating on wordpress.org, a post in the support forum when something is off, or a hand with the translation.

Frequently asked questions

How do I password-protect an entire WordPress site?

Install the plugin, open Settings, Password Protect, tick Enable password protection for the entire site and set a password. The per-post password built into WordPress covers a single post; this covers everything on the front end.

Can I still work on the site while it is protected?

Yes. Anyone logged in to WordPress bypasses the gate, so editing, previewing and publishing work exactly as before. Open a private window to see what visitors see.

Does it work with caching plugins?

Yes. The gate is sent with no-cache headers before any cached content, and a visitor with a valid cookie gets the page as usual. Pages cached before you switched the protection on can still be served from the cache, so clear it once after enabling.

Is the password stored securely?

It is stored as a bcrypt hash, the algorithm WordPress uses for account passwords since 6.8, never in plain text. There is no length limit and special characters are kept exactly as typed.

How often do visitors have to enter the password?

Once every 24 hours. The cookie holds a token derived from your site salt and the password hash, not the password. Changing the password ends every session at once.

Can I brand the password screen?

Yes. Logo and shape, title, intro text, background, button, button text and link color are settings. No CSS needed, and no CSS field either.

Why are there links to legal pages on the gate?

In several countries the legal notice and the privacy policy must be reachable without any prior step, on a password page too. Pick the two pages in the settings and they open in a modal; the links can also be hidden.

Does every visitor get their own account?

No. Everyone shares one password. Individual logins, roles and access records are what membership plugins do; this one stays deliberately simpler.

Does it hide the site from Google?

The gate carries a noindex, nofollow tag, so search engines do not list it, and the REST API answers no visitor without the password. Uploaded media files stay reachable by direct link, because the web server delivers them without asking WordPress. Pages indexed before you switched the protection on drop out over time; for a staging site, tick Discourage search engines under Settings, Reading as well.

What happens on uninstall?

The settings and the password hash are removed. Your pages and posts are never touched.

Is there a Pro version?

No, and none is planned. Every feature is in the free plugin.

Changelog

1.1.1

Oct 12, 2026: security release: the legal modal only loads the two configured legal pages, the REST API is closed for visitors without the password (filter spwdprot_protect_rest_api keeps it open), the redirect after the password only goes to addresses on your own site; tested up to WordPress 7.1.

1.1.0

Oct 30, 2025: optional Admin Login button, a switch to hide the legal links, legal links now show the page titles; password handling fixed: no length limit, every character preserved, reliable storage; admin screen tidied.

1.0.0

Aug 15, 2025: first release: site-wide gate, logo, title, text and colors, legal pages in a modal, hashed password, 24-hour cookie, bypass for logged-in users.

Full changelog on WordPress.org

More from desk9

Notice Planner A closure notice that appears on time and leaves on its own. For the day the gate comes down.

Cookie Banner & Content Blocker YouTube, Maps and Analytics stay inert until the visitor says yes.

All desk9 plugins Ten of them, maintained monthly, seven free.

Free forever. No Pro, no nag screens.

Every feature is in the free version. Updates arrive through WordPress, no account and no license key.

Download free All desk9 plugins →

At a glance

wordpress.org rating5 / 5

Version1.1.1

Last updateOct 12, 2026

Requires WP6.8+

Tested up to7.1.3

PHP7.4+

LicenseGPL

Why it is free

Every feature is in the free plugin, and it stays that way. If it saves you time, a review on wordpress.org is the best way to say thanks.

All desk9 plugins →