How to Password Protect a Web Page (Secure Methods + Simple Scripts)

Need to password protect a web page so only certain people can see it? Back in 2005 we shared two simple JavaScript scripts to do it. They still work as a light privacy screen, but anyone who views the page source can read the password. In 2026 there are much safer and still easy ways. Here’s how to password protect a web page properly, plus the original scripts (updated) if you just need a quick, casual lock.

Quick answer: On WordPress, set the page’s Visibility to Password protected. On a regular website, use your hosting panel’s Password Protect Directories option (or an .htaccess and .htpasswd file), which makes the server ask for a username and password before showing anything. Avoid JavaScript-only passwords for anything private.

Secure ways to password protect a web page

1. WordPress password protected pages

In the WordPress editor, open the Visibility setting (in the Publish box or the post sidebar), choose Password protected, type a password and update. Visitors see a password form instead of the content. WordPress explains this in its content visibility guide. For stronger control, a membership or private site plugin can require users to log in.

2. Your hosting control panel

Most web hosts can protect a folder without any code. In cPanel look for Directory Privacy; on other panels (including Hostinger’s hPanel) look for Password Protect Directories. Pick the folder, add a username and password, and the server will block everyone else.

3. .htaccess and .htpasswd (Apache and LiteSpeed servers)

This is the classic server-side method, called HTTP Basic Authentication. Create a password file outside your public folder, for example with this command on the server:

htpasswd -c /home/user/.htpasswd yourname

Then add this to the .htaccess file in the folder you want to protect:

AuthType Basic
AuthName "Private area"
AuthUserFile /home/user/.htpasswd
Require valid-user

The browser now shows a login box before loading any file in that folder. Always use HTTPS so the password isn’t sent in plain text. If you’re new to .htaccess, see our guide to .htaccess rules for 410 error pages for how the file works.

4. Nginx servers

On Nginx, the same idea uses the auth_basic and auth_basic_user_file settings inside a location block, as described in the Nginx documentation.

5. Cloudflare Access

If your site uses Cloudflare, Cloudflare Access can put a login page (for example, a one-time code sent to approved email addresses) in front of any page or folder. It’s free for small teams and doesn’t need any code on your site.

6. Website builders and static hosts

Many site builders and static hosting services include a page password setting, sometimes only on paid plans. Check your platform’s settings for “password protection” or “private page”.

Simple JavaScript password scripts (not secure)

These are our original 2005 scripts, cleaned up for modern browsers. They’re fine for hiding a fun surprise page or a draft from casual visitors, but remember:

• Anyone can view the page source and read the password.
• The protected page itself isn’t hidden. If someone knows its address, they can open it directly.
• They don’t work if JavaScript is turned off.

Never use them for personal data, client files or anything that must stay private.

Password script 1: username and password form

This shows a small login form. If the username and password match, the visitor is sent to the private page. Replace SECRET_USER, SECRET_PASSWORD and the page address with your own.

<form onsubmit="return checkLogin(this)">
  Username: <input name="user" type="text">
  Password: <input name="pass" type="password">
  <button type="submit">Login</button>
</form>
<script>
function checkLogin(form) {
  if (form.user.value === "SECRET_USER" && form.pass.value === "SECRET_PASSWORD") {
    window.location.href = "https://YOURDOMAIN.com/private-page.html";
  } else {
    alert("Wrong username or password");
  }
  return false;
}
</script>

Password script 2: password prompt on page load

Put this in the <head> of the page you want to lock. It asks for a password when the page opens and sends everyone with the wrong password to another page.

<script>
var password = prompt("Enter password");
if (password !== "SECRET_PASSWORD") {
  window.location.href = "https://YOURDOMAIN.com/";
}
</script>

Frequently asked questions

Can I password protect a web page without a server?

Only weakly. JavaScript passwords run in the visitor’s browser, so they can always be bypassed. For real protection you need the server, WordPress or a service like Cloudflare Access to check the password.

Is a password protected page hidden from Google?

Pages behind server-side or WordPress passwords can’t be read by Google, so their content won’t appear in search. Pages “protected” only by JavaScript can still be found and indexed.

How do I password protect a page on Google Sites or Blogger?

Neither offers per-page passwords. Instead, share the whole site or blog only with chosen Google accounts in its sharing or permissions settings.