WordPress handles a lot of things well by default. Page-level access control isn’t really one of them.
Out of the box, you get two options: a page is either public or it requires a full WordPress account to view. There’s no middle ground. If you want to share something with a client, a beta tester, or anyone who shouldn’t need to create a login — your options get awkward pretty fast.
The built-in password protection in WordPress does exist. You’ve probably seen it. You set a password, and WordPress puts up a form that says “This content is password protected. To view it please enter your password below.” One shared password, no way to customise the lock screen, no logging of who accessed it. It works, technically. It just doesn’t inspire a lot of confidence when you’re sharing something with a client who’s already judging your attention to detail.
The actual scenarios where this comes up
The need for single-page password protection turns up more often than you’d expect:
You’ve built a staging version of a client’s new homepage and want to share it without exposing the whole staging site. Or you’ve written a resource guide — a checklist, a process doc, a template — that you want to sell or give away as a lead magnet, but it lives on your WordPress site. Or there’s an internal announcement page, a team resource, something meant for a specific group that you just don’t want publicly indexed.
In every one of those cases, WordPress’s native solution is… not great.
The plugin approach
I’ve used a few different plugins for this over the years. Most of them either do too much — full membership systems when all you need is one locked page — or they add the password protection as an afterthought, with a lock screen that looks like a browser’s built-in HTTP auth dialog.
What I wanted was something where the lock screen itself looked considered. The visitor lands on a page, sees something that looks intentional — your branding, a short message, a clean password field — and if they have the password, they’re in. Simple.
That’s the problem PageBlocker was built to solve.
How it actually works
You install it, go to any page or post in your WordPress editor, and there’s a new metabox in the sidebar: enable protection, set a password, pick your lock screen style, write a custom message. That’s the whole setup.
The lock screen options cover the main use cases. There’s a clean minimal style for professional contexts — client previews, gated resources, internal pages. A dark overlay style that works well for portfolio pieces or launch pages. And a branded option where you can pull in your site’s own header so the lock screen looks like it belongs on your site.
Once someone enters the correct password, WordPress sets a session cookie — they stay unlocked for as long as you configure, no need to re-enter the password on every visit. You can also set an expiry on the protection itself, useful if you’re sharing something temporarily and want it to auto-unlock after a date without remembering to go back in and turn it off.
The part that saves time on client work
One thing I’ve found genuinely useful for client projects: you can bypass protection for logged-in users automatically. So while you’re working on the page and testing it, you see the full content. The client, who doesn’t have a WordPress account, sees the lock screen. When you’re ready to share it with them, you hand over the password.
There’s also a redirect option — instead of showing a lock screen, visitors who don’t have access get sent to a different page entirely. That’s useful when you want to keep the existence of certain content private, not just the content itself.
One thing to be clear about
Password-protecting a WordPress page is not the same as server-level security. If someone is determined enough and technical enough, there are ways around any client-side lock. This is the right tool for keeping casual visitors out of content that isn’t for them — a client preview, an internal doc, a gated resource. It’s not a substitute for proper access control on genuinely sensitive data.
For most real-world use cases though — client work, content marketing, private team pages — it’s exactly the right level of friction.
When you actually need this
If you do a lot of client work in WordPress, PageBlocker becomes a standard part of the toolkit. The ability to show a client a live page — on their actual domain, in their actual theme — without making it publicly visible is genuinely useful. A lot of clients can’t visualise what a staging environment is trying to show them. A real URL on a real domain, with a simple password to get in, clicks for them in a way that a staging subdomain often doesn’t.
The same logic applies to lead magnets. If you’re giving away a PDF or a resource page, you don’t need a full membership plugin. A clean lock screen with a password you send to subscribers does the same job with a fraction of the setup complexity.
PageBlocker is available on Gumroad — instant download, works with any WordPress theme.