WordPress can require a shared password before displaying a post or page's protected content. This is useful for limited informal sharing, but it is not a full membership system and does not automatically secure every uploaded file linked from that content.
IN THIS ARTICLE
01 Choose the appropriate access method
A shared password can be passed to someone else, and it does not identify each reader individually. If you need account-based permissions, individual revocation, payment access or audit records, use a properly configured access-control solution instead.
Review the title, excerpt, featured image and custom template output. The protected body is not the same as a guarantee that every detail associated with the post is hidden. Avoid placing sensitive information in publicly displayed labels.
02 Apply protection
- Edit the intended post or page and open its visibility settings.
- Choose Password protected and set a strong shared password appropriate to the audience.
- Save or publish the content, then distribute the password through a suitable private channel.
- Open the public URL in a clean browser session and confirm that the content requires the password.
How do I check what password protection actually covers?
Check the page before entering the password and after entering it. Review related-post widgets, search results and any plugin-generated previews. Test linked documents directly, since a public Media Library URL may bypass the page's password prompt.
A browser may retain access through a cookie after the password is entered. Use a fresh private session when testing the first-visit experience rather than assuming protection failed because your usual browser still shows the content.
03 Maintain and revoke access
Change the password when the audience changes, then recheck the public response and relevant caches. Do not reuse an administrator login password as the shared content password.
If a plugin or cache displays protected content unexpectedly, stop sharing the URL and investigate the interaction. Special pages, including a page assigned as the posts index, can behave differently from an ordinary page. For sensitive data, confirm the complete access boundary with a developer instead of relying on one visibility setting.