{"id":56,"date":"2005-02-22T21:20:00","date_gmt":"2005-02-22T15:50:00","guid":{"rendered":"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/"},"modified":"2026-10-06T19:32:29","modified_gmt":"2026-10-06T14:02:29","slug":"simple-scripts-to-password-protect-your-webpage","status":"publish","type":"post","link":"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/","title":{"rendered":"How to Password Protect a Web Page (Secure Methods + Simple Scripts)"},"content":{"rendered":"<p>Need to password protect a web page so only certain people can see it? Back in 2005 we shared two simple JavaScript scripts to do it. They still work as a light privacy screen, but anyone who views the page source can read the password. In 2026 there are much safer and still easy ways. Here&#8217;s how to password protect a web page properly, plus the original scripts (updated) if you just need a quick, casual lock.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-32739\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-scripts.jpg\" alt=\"How to password protect a web page\" width=\"250\" height=\"250\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-scripts.jpg 250w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-scripts-150x150.jpg 150w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-scripts-120x120.jpg 120w\" sizes=\"(max-width: 250px) 100vw, 250px\" \/><\/p>\n<p><strong>Quick answer:<\/strong> On WordPress, set the page&#8217;s <strong>Visibility<\/strong> to <strong>Password protected<\/strong>. On a regular website, use your hosting panel&#8217;s <strong>Password Protect Directories<\/strong> option (or an <code>.htaccess<\/code> and <code>.htpasswd<\/code> file), which makes the server ask for a username and password before showing anything. Avoid JavaScript-only passwords for anything private.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_88 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6ac6fd698bde0\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"ez-toc-cssicon\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #1a202c;color:#1a202c\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #1a202c;color:#1a202c\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ac6fd698bde0\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#Secure_ways_to_password_protect_a_web_page\" >Secure ways to password protect a web page<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#1_WordPress_password_protected_pages\" >1. WordPress password protected pages<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#2_Your_hosting_control_panel\" >2. Your hosting control panel<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#3_htaccess_and_htpasswd_Apache_and_LiteSpeed_servers\" >3. .htaccess and .htpasswd (Apache and LiteSpeed servers)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#4_Nginx_servers\" >4. Nginx servers<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#5_Cloudflare_Access\" >5. Cloudflare Access<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#6_Website_builders_and_static_hosts\" >6. Website builders and static hosts<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#Simple_JavaScript_password_scripts_not_secure\" >Simple JavaScript password scripts (not secure)<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#Password_script_1_username_and_password_form\" >Password script 1: username and password form<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#Password_script_2_password_prompt_on_page_load\" >Password script 2: password prompt on page load<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#Frequently_asked_questions\" >Frequently asked questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#Can_I_password_protect_a_web_page_without_a_server\" >Can I password protect a web page without a server?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#Is_a_password_protected_page_hidden_from_Google\" >Is a password protected page hidden from Google?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/#How_do_I_password_protect_a_page_on_Google_Sites_or_Blogger\" >How do I password protect a page on Google Sites or Blogger?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Secure_ways_to_password_protect_a_web_page\"><\/span>Secure ways to password protect a web page<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"1_WordPress_password_protected_pages\"><\/span>1. WordPress password protected pages<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>In the WordPress editor, open the <strong>Visibility<\/strong> setting (in the Publish box or the post sidebar), choose <strong>Password protected<\/strong>, type a password and update. Visitors see a password form instead of the content. WordPress explains this in its <a href=\"https:\/\/wordpress.org\/documentation\/article\/content-visibility\/\" target=\"_blank\" rel=\"noopener\">content visibility guide<\/a>. For stronger control, a membership or private site plugin can require users to log in.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"2_Your_hosting_control_panel\"><\/span>2. Your hosting control panel<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Most web hosts can protect a folder without any code. In cPanel look for <strong>Directory Privacy<\/strong>; on other panels (including Hostinger&#8217;s hPanel) look for <strong>Password Protect Directories<\/strong>. Pick the folder, add a username and password, and the server will block everyone else.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"3_htaccess_and_htpasswd_Apache_and_LiteSpeed_servers\"><\/span>3. .htaccess and .htpasswd (Apache and LiteSpeed servers)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This is the classic server-side method, called HTTP Basic Authentication. Create a password file outside your public folder, for example with this command on the server:<\/p>\n<pre><code>htpasswd -c \/home\/user\/.htpasswd yourname<\/code><\/pre>\n<p>Then add this to the <code>.htaccess<\/code> file in the folder you want to protect:<\/p>\n<pre><code>AuthType Basic\r\nAuthName \"Private area\"\r\nAuthUserFile \/home\/user\/.htpasswd\r\nRequire valid-user<\/code><\/pre>\n<p>The browser now shows a login box before loading any file in that folder. Always use HTTPS so the password isn&#8217;t sent in plain text. If you&#8217;re new to <code>.htaccess<\/code>, see our guide to <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2014\/11\/http-410-error-pages-htaccess\/\">.htaccess rules for 410 error pages<\/a> for how the file works.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"4_Nginx_servers\"><\/span>4. Nginx servers<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>On Nginx, the same idea uses the <code>auth_basic<\/code> and <code>auth_basic_user_file<\/code> settings inside a <code>location<\/code> block, as described in the <a href=\"https:\/\/nginx.org\/en\/docs\/http\/ngx_http_auth_basic_module.html\" target=\"_blank\" rel=\"noopener\">Nginx documentation<\/a>.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"5_Cloudflare_Access\"><\/span>5. Cloudflare Access<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>If your site uses Cloudflare, <a href=\"https:\/\/www.cloudflare.com\/zero-trust\/products\/access\/\" target=\"_blank\" rel=\"noopener\">Cloudflare Access<\/a> can put a login page (for example, a one-time code sent to approved email addresses) in front of any page or folder. It&#8217;s free for small teams and doesn&#8217;t need any code on your site.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"6_Website_builders_and_static_hosts\"><\/span>6. Website builders and static hosts<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Many site builders and static hosting services include a page password setting, sometimes only on paid plans. Check your platform&#8217;s settings for &#8220;password protection&#8221; or &#8220;private page&#8221;.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Simple_JavaScript_password_scripts_not_secure\"><\/span>Simple JavaScript password scripts (not secure)<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>These are our original 2005 scripts, cleaned up for modern browsers. They&#8217;re fine for hiding a fun surprise page or a draft from casual visitors, but remember:<\/p>\n<ul>\n<li>Anyone can view the page source and read the password.<\/li>\n<li>The protected page itself isn&#8217;t hidden. If someone knows its address, they can open it directly.<\/li>\n<li>They don&#8217;t work if JavaScript is turned off.<\/li>\n<\/ul>\n<p>Never use them for personal data, client files or anything that must stay private.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Password_script_1_username_and_password_form\"><\/span>Password script 1: username and password form<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>This shows a small login form. If the username and password match, the visitor is sent to the private page. Replace <code>SECRET_USER<\/code>, <code>SECRET_PASSWORD<\/code> and the page address with your own.<\/p>\n<pre><code>&lt;form onsubmit=\"return checkLogin(this)\"&gt;\r\n  Username: &lt;input name=\"user\" type=\"text\"&gt;\r\n  Password: &lt;input name=\"pass\" type=\"password\"&gt;\r\n  &lt;button type=\"submit\"&gt;Login&lt;\/button&gt;\r\n&lt;\/form&gt;\r\n&lt;script&gt;\r\nfunction checkLogin(form) {\r\n  if (form.user.value === \"SECRET_USER\" &amp;&amp; form.pass.value === \"SECRET_PASSWORD\") {\r\n    window.location.href = \"https:\/\/YOURDOMAIN.com\/private-page.html\";\r\n  } else {\r\n    alert(\"Wrong username or password\");\r\n  }\r\n  return false;\r\n}\r\n&lt;\/script&gt;<\/code><\/pre>\n<h3><span class=\"ez-toc-section\" id=\"Password_script_2_password_prompt_on_page_load\"><\/span>Password script 2: password prompt on page load<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Put this in the <code>&lt;head&gt;<\/code> of the page you want to lock. It asks for a password when the page opens and sends everyone with the wrong password to another page.<\/p>\n<pre><code>&lt;script&gt;\r\nvar password = prompt(\"Enter password\");\r\nif (password !== \"SECRET_PASSWORD\") {\r\n  window.location.href = \"https:\/\/YOURDOMAIN.com\/\";\r\n}\r\n&lt;\/script&gt;<\/code><\/pre>\n<h2><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Can_I_password_protect_a_web_page_without_a_server\"><\/span>Can I password protect a web page without a server?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Only weakly. JavaScript passwords run in the visitor&#8217;s browser, so they can always be bypassed. For real protection you need the server, WordPress or a service like Cloudflare Access to check the password.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Is_a_password_protected_page_hidden_from_Google\"><\/span>Is a password protected page hidden from Google?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Pages behind server-side or WordPress passwords can&#8217;t be read by Google, so their content won&#8217;t appear in search. Pages &#8220;protected&#8221; only by JavaScript can still be found and indexed.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"How_do_I_password_protect_a_page_on_Google_Sites_or_Blogger\"><\/span>How do I password protect a page on Google Sites or Blogger?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Neither offers per-page passwords. Instead, share the whole site or blog only with chosen Google accounts in its sharing or permissions settings.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Need to password protect a web page so only certain people can see it? Back in 2005 we shared two&#8230;<\/p>\n","protected":false},"author":4,"featured_media":32739,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"default","_kad_post_title":"default","_kad_post_layout":"default","_kad_post_sidebar_id":"","_kad_post_content_style":"default","_kad_post_vertical_padding":"default","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[7],"tags":[49],"class_list":["post-56","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security","tag-tutorials"],"_links":{"self":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/56","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/comments?post=56"}],"version-history":[{"count":1,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/56\/revisions"}],"predecessor-version":[{"id":63291,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/56\/revisions\/63291"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media\/32739"}],"wp:attachment":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media?parent=56"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/categories?post=56"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/tags?post=56"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}