MS Password Protect for WordPress
Put your whole site behind a password while you build it or show it to a client, or lock only the pages, categories and post types you choose. Give each person their own named password, show your own password screen, and keep locked content out of the REST API, feeds, sitemaps and search.
A private site, or private pages, in a few clicks
Everything listed here is free. Deactivate the plugin and your site is exactly as it was.
Lock the whole site, with exceptions
Put the whole site behind a password while you build it or show it to a client, and keep the home page, chosen pages or addresses such as /contact or /landing/* public.
Or lock only what you choose
Lock chosen pages (and their child pages), categories, whole post types or addresses such as /members/*. A box on every edit screen locks a post, product or page with one click.
Several passwords, each with a name
Give each client or group their own password with a label. Remove one and only the people who used it must enter a password again. See how often and when each was last used.
Who can pass
Administrators always see everything. Let every logged-in user through, or only the roles you choose, or IP addresses and ranges (CIDR). A proxy header is only believed for requests from proxy addresses you list.
Your own password screen
Set the heading, message, button text, a footer line, your logo and five colours, with a live preview. It is shown without the theme, so no theme or page builder can break it, and offers "Remember me on this device".
No side doors
Locked content is also locked or left out in the REST API, feeds, sitemaps, search results, embeds, archives, comment lists and attachment pages. Login, the dashboard, WP-Cron and WooCommerce payment callbacks stay open.
Works with page caches
Locked pages are sent with "do not cache" headers that common cache plugins and most hosts follow. A one-click caching check asks your site for locked addresses the way a stranger would and tells you if a cache shows them.
Safe by design
Passwords are stored as WordPress password hashes. The unlock cookie is signed with your site's secret keys. Wrong guesses are limited (5 tries, then 15 minutes, both adjustable) and the password screen tells search engines not to index it.
For developers
WP-CLI commands to check status, lock, unlock and manage passwords, a shortcode for a log out link, and filters and an action to change who is let through.
See it in action
Good to know
What’s new
First version: whole-site or selected lock, named passwords, logged-in, role and IP bypass, your own password screen, REST API, feed, sitemap, search and embed protection, caching check, wrong-guess limit, WP-CLI.
Common questions
Is MS Password Protect free?
Yes. Everything listed on this page is free, with no trial and no limit.
Is MS Password Protect made by Microsoft?
No. "MS" stands for MatrixInn Solutions, the team that makes it. The plugin is not affiliated with Microsoft or with any other password plugin.
I am logged in and do not see the password screen.
Administrators always pass, and by default every logged-in user does. Open the site in a private window to see what visitors see.
Visitors still see a locked page.
A page cache probably kept a copy from before the lock. Clear the cache, then run the Caching check under Settings > MS Password Protect > Advanced. If the check still finds the page, exclude visitors with the cookie minn_pp_auth in your cache plugin or Cloudflare rule.
Are my images and PDFs locked too?
Pages that show them are locked, but a file's direct address in the uploads folder is served by the web server without WordPress, so a visitor who already has the exact file address can still open it.
Does it change WordPress's own post passwords?
No. Posts with a WordPress post password keep working as before, with or without this plugin.
Will search engines index my locked site?
Locked pages answer with status 401 and a "noindex" header, so search engines do not index them.
I locked myself out of my own preview.
Log in at /wp-login.php: logins are never locked. Or run wp ms-pp unlock.
When can I download it?
It has been submitted to WordPress.org and is waiting for review. Email us and we will tell you when it is live.
Want it the day it goes live?
MS Password Protect is waiting for WordPress.org review. Email us and we’ll let you know when you can install it, or ask us anything about locking your site. We reply within one business day.
info@matrixinnsolutions.com