A real password check happens on the server before the page is sent. Use your host's or site builder's page password setting, HTTP Basic authentication in Apache or Nginx, or proper member accounts. A password box written in JavaScript only hides the page in the browser; the content still arrives and anyone can read the source.
| Option | Protects content? | Best for |
|---|---|---|
| Builder or CMS page password | Yes, checked by the platform | One private page for a client or event |
| HTTP Basic auth (Apache, Nginx) | Yes, over HTTPS | A staging site or a whole folder |
| Member accounts | Yes, per person | Paid or long-running private areas |
| JavaScript prompt or hidden div | No | Nothing that matters |
Updated
Type a username and password to see the exact Authorization header a browser sends under Basic authentication, and how easily it turns back into plain text. It shows why Basic auth must only run over HTTPS. The encoding happens on your device; nothing is sent.
Username: client
Password: spring-preview
The username cannot contain a colon, because the colon separates it from the password.
Header the browser sends with every request
Authorization: Basic Y2xpZW50OnNwcmluZy1wcmV2aWV3Decoded by anyone who sees the request
client:spring-previewBase64 is not encryption. Without HTTPS, this header gives the password away.
Create the password file with the htpasswd tool that ships with Apache (for example htpasswd -c /etc/apache2/.htpasswd client), and keep it outside the public web folder.
Require valid-user lets in anyone listed in the password file.
AuthType Basic
AuthName "Private preview"
AuthUserFile /etc/apache2/.htpasswd
Require valid-userNginx reads the same htpasswd file format. Reload Nginx after editing.
location /preview/ {
auth_basic "Private preview";
auth_basic_user_file /etc/apache2/.htpasswd;
}Shown so you can recognise it. The password and the content are both in the file every visitor downloads.
<div id="secret" hidden>Client price list ...</div>
<script>
if (prompt("Password?") === "spring-preview") {
document.getElementById("secret").hidden = false;
}
</script>A common tutorial adds a prompt() and compares the answer with a password written in the same script. The browser has already downloaded the full page, and the password sits in the source for anyone who presses view source. Turning off JavaScript skips the check altogether.
The same goes for content hidden with CSS. If the words are in the HTML, they are public.
For one page you share with a client, the page password in your builder or CMS is the quickest safe choice. For a staging copy of a site, Basic auth on the server keeps the whole thing private, including from search engine crawlers.
When different people need different access, or you need to remove one person later, use accounts. A single shared password cannot be taken back from one person without changing it for everyone.
No. HTML has no way to check a password. Anything you put in the file is downloaded by every visitor, so the check has to happen on the server or platform.
Only over HTTPS. RFC 7617 points out that the password crosses the network in cleartext, because Base64 is an encoding, not encryption, and says the scheme should not protect sensitive information without something like HTTPS.
Open the page or post, set Visibility to Password protected, enter a password and update. Visitors see the title and a password prompt instead of the content.
WordPress's own documentation says hiding the entire site is not part of core, and points to plugins or server rules such as .htaccess.
The server answers with 401 and a WWW-Authenticate header. The browser then asks for a username and password and repeats the request with an Authorization header.
Related: 401 vs 403, Authentication guide, Make a membership website, HTTP status codes.
Start for free or see all free tools. We.Inc is free to start, with no card needed. AI building is on paid plans from $20 a month.
We.Inc is an AI-powered website builder you can resell under your own brand. Launch a branded client dashboard, bill on Stripe Connect, and deliver AI-generated websites in minutes. White-label plans start at $99 a month for 25 client sites, with a 7-day free trial and no per-site fees.