WORDPRESS PLUGIN · FREE · GPLv2
One Password. Your Whole Site.
Not ready for the public yet? Close the door.
Simple Password Protect puts your entire WordPress front end behind a single password — on a clean, branded screen with your logo, your colours and your legal links. Administrators walk straight through. Everyone else needs the password.
★★★★★ 5.0 from 1 review on WordPress.org
400+ active installations · Free & GPLv2 · WordPress password hashing · Works with caching plugins
The problem: unfinished sites don’t stay private on their own
A staging site gets indexed. A client shares a preview link one email too far. A relaunch goes live with placeholder text still in the footer. “Nobody knows the URL” is not access control — and a noindex tag only asks search engines politely. Meanwhile the real fix, a membership plugin or an .htaccess file, is far more machinery than the situation deserves.
The solution: one password in front of everything
Switch the plugin on, set a password, and every front-end request meets a login screen first. It carries your logo, your colours and your wording, so a client preview still looks like your work rather than a server error. You keep working in the admin as usual — logged-in administrators are never asked.
Live in under a minute
One checkbox, one password field, save. No server config, no .htaccess, no user accounts to create and delete afterwards.
It still looks like you
Logo, shape, title, intro text, background and button colours. Clients meet a finished-looking gate, not a raw browser prompt.
Nothing leaves your server
The password is hashed with WordPress’ own functions and stored in your database. No external service, no analytics, no data sent anywhere.
Plugin features
Everything you need to close a WordPress site to the public — and nothing that gets in your way while you build it.
Site-wide front-end protection
One switch protects the whole front end — home page, posts, pages, archives. There is no page-by-page list to maintain and nothing to forget when you add content later.
Secure authentication
The password is hashed with the same WordPress functions used for user accounts and never stored in plain text. Successful logins set a secure cookie.
24-hour sessions
Visitors enter the password once and stay in for a day. Clients reviewing a site over an afternoon are not asked again on every page.
Admin bypass
Logged-in administrators reach the site without entering anything. You build, preview and publish exactly as before — the gate only exists for everyone else.
Optional admin login button
Added in 1.1.0: a second button on the password screen that leads straight to wp-admin, styled to match the main button. Handy when you land on the gate in a fresh browser.
Your logo, your shape
Upload a logo or point to a URL, then choose how it is displayed — round, square or plain. A live preview in the settings shows the result before you save.
Your wording
Set the page title and a short line of intro text. “Relaunch in progress — the password is in your last email” beats a bare password box every time.
Your colours
Background, button, button text and link colour are separate fields with a colour picker, so the gate can carry a brand palette instead of a default blue.
Legal links in a modal
Pick your Legal Disclosure and Privacy Policy pages and they appear as links below the button, opening in a modal. Visitors reach them without passing the gate — and 1.1.0 shows the real page titles and lets you hide the links entirely.
Cache-friendly and responsive
The password screen is delivered before cached content, so it works alongside common caching plugins, and it scales down cleanly to phones and tablets.
What people use it for
Staging & development sites
Keep work in progress out of search results and away from anyone who guesses the subdomain.
Client previews
Hand over one link and one password instead of creating throwaway user accounts for every review round.
Private and family blogs
Publish for a circle of people who all share the same password — no registration, no profiles, no member management.
Relaunches and coming-soon phases
Put a branded gate in front of the new site until launch day, then switch the protection off in one click.
Live in three steps
- Install and activate the plugin from the WordPress plugin directory.
- Open Settings → Password Protect, tick “Enable password protection” and set a password.
- Add your logo, wording, colours and legal pages — then save. The gate is live.
Turning it off again is the same checkbox. Nothing is left behind on your pages, and your content is untouched throughout.
Technical details
| Version | 1.1.0 |
| WordPress | 6.8 or higher |
| Tested up to | 6.8.8 |
| PHP | 7.4 or higher |
| Settings | Settings → Password Protect |
| Session | 24 hours |
| License | GPLv2 or later |
Screenshots
What it is — and what it isn’t
Simple Password Protect is shared-secret access control for a WordPress front end. One password, handed to everyone who should get in, valid for 24 hours per visitor. That is exactly the right tool for a staging site, a client preview, a relaunch or a blog written for a circle of people.
It is not a membership system: there are no individual accounts, no roles for visitors and no way to see who logged in. It is also not a substitute for server-level protection of genuinely sensitive material — confidential documents belong behind proper authentication, not behind a password everybody shares.
The privacy side is simple. A hashed password lives in your database and a secure cookie is set once someone gets in. Nothing is collected, nothing is transmitted, and no external service is involved. The Legal Disclosure and Privacy Policy links exist so visitors can reach those pages before entering anything — a sensible default, though whether your setup meets a specific legal requirement is still your call.
Frequently asked questions
How do I password-protect an entire WordPress site?
Install Simple Password Protect, open Settings → Password Protect, tick “Enable password protection for the entire site” and enter a password. From that moment every front-end page asks for it. WordPress’ own per-post password field only covers one post at a time; this covers everything.
Can I still work on the site while it is protected?
Yes. Logged-in administrators bypass the password screen entirely, so editing, previewing and publishing work exactly as before.
Does it work with caching plugins?
Yes. The password screen is delivered before cached content is served, so it works alongside the common caching plugins.
Is the password stored securely?
It is hashed with the same WordPress functions used for user account passwords and never kept in plain text. Since 1.1.0 there are no length limits and no sanitisation that could alter special characters, so long passphrases work as typed.
How often do visitors have to enter the password?
Once per 24 hours. A secure cookie keeps them in for the rest of the session, which is long enough for a client to review a site over an afternoon without being interrupted.
Can I brand the password screen?
Yes. Logo and logo shape, page title, intro text, background colour, button colour, button text colour and link colour are all configurable — no CSS required.
Why are there links to legal pages on the gate?
In several jurisdictions a legal notice and a privacy policy have to be reachable without any prior step. You select the two pages in the settings and they open in a modal on the password screen — and if your setup does not need them, 1.1.0 lets you switch the links off.
Does it give each visitor their own account?
No. Everyone shares one password. If you need individual logins, roles or a record of who accessed what, you want a membership plugin instead — this is deliberately the simpler tool.
Does the plugin send data anywhere?
No. A hashed password is stored in your database and a secure cookie is set on successful entry. No personal data is collected and nothing is transmitted to external services.
Is Simple Password Protect free?
Yes. It is published in the official WordPress plugin directory under GPLv2 or later, with no paid tier and no upsell inside the plugin.
Changelog
1.1.0
- New: optional admin login button on the password screen for quick access to
wp-admin. - New: toggle to show or hide the legal page links.
- Legal links now display the actual page titles instead of hardcoded text.
- Fixed: password authentication now works reliably with every type of password.
- Fixed: password storage in the database made reliable; length restrictions removed and characters are preserved exactly as typed.
- Improved: admin button styling and positioning, a cleaner settings screen, and better WordPress Coding Standards compliance.
1.0.0
- Initial release: global password protection for the entire front end.
- Secure password hashing and cookie-based authentication with admin bypass.
- Customisable appearance and colours, GDPR-minded modal links, mobile-responsive design.
Close your site in one click
Free, GPL-licensed, and installed in under a minute from the WordPress plugin directory.
Version 1.1.0 · GPLv2 or later · Desk9 Design