Gatekeepr – Password Protect for Post Types
Gatekeepr lets you require a password before visitors can view the single/detail page of any post type — Posts, Pages, or any custom post type registered by your theme or another plugin.
Unlike WordPress’s built-in per-post password protection, this plugin protects an entire post type at once from a single settings screen — with either one shared password for everything, or an individual password per post type.
Features
- Choose exactly which post types are protected — every public post type is listed with a toggle, including custom post types.
- Two password modes: one shared password for everything, or an individual password per protected post type.
- Visitors who enter the correct password stay unlocked for a configurable number of days (cookie-based), instead of being asked every visit.
- Changing a password immediately invalidates every visitor’s existing unlock for it — no manual cleanup needed.
- Logged-in users who can edit a given post always see it directly, so editing and previewing is never blocked.
- Clean, standalone unlock screen that doesn’t depend on your active theme, so it renders consistently even on page-builder sites.
- Customize the unlock screen: background color, accent color, an uploaded logo, and an optional secondary button (e.g. “Contact us”) linking anywhere you choose.
- Built-in brute-force throttling on the password form.
- The REST API and RSS/Atom feeds are gated too, so protected content isn’t readable through either while locked.
- Protected post types are automatically excluded from XML sitemaps (core WordPress sitemaps, Yoast SEO, and Rank Math), so they aren’t advertised to search engines.
- A small “Protected” indicator appears in the post list table for any post type that’s currently gated, so editors can see it at a glance.
- Compatible with full-page caching plugins — protected pages are automatically excluded from the page cache so one visitor’s session is never served to another.
- No external requests, no tracking, no bundled third-party services.
Development happens in the open on GitHub: https://github.com/bilalkk9/post-type-password-protect
A note on the “current password” display
The Gatekeepr settings screen can show you the current password (hidden by default, behind a “Show” toggle) so you don’t need to reset it if you’ve forgotten it. To make this possible, the password is stored in an encrypted, recoverable form rather than only as a one-way hash. If your workflow requires a password that can never be viewed after saving, simply treat the field as write-only and don’t use the “Show” toggle — the underlying visitor-facing verification always uses a one-way hash regardless.