GatePass is a modern, lightweight, and high-performance password protection and content protector plugin built to lock your entire WordPress site, specific pages, posts, WooCommerce products, or partial content behind a secure, customizable password protected screen.

Whether you need to password protect a staging site, restrict access to an in-progress client website, create a private company intranet, lock wholesale WooCommerce products & categories, or gate premium articles, GatePass delivers professional password protection and content restriction without slowing down your site.

Unlike complex membership plugins or bloated security suites, GatePass gives you complete control over password protected pages, posts, and sitewide locking with a modern, intuitive dashboard to manage passcodes, role whitelists, and passwordless magic bypass links.

⚡ Key Password Protection Features

Password Protect Entire WordPress Site: Lock your entire website behind a single passcode screen in just one click (sitewide protection).
Password Protect Pages & Posts: Securely password protect individual WordPress pages, blog posts, or custom post types globally.
WooCommerce Password Protect: Lock wholesale catalogs, member-only items, private pricing, and shop pages behind a password gate.
Magic Access Links (Passwordless Bypass): Generate one-click direct bypass URLs so clients, stakeholders, or reviewers can access protected content without entering a password.
Role-Based Whitelist Bypass (Passwordless Admin Access): Automatically allow trusted WordPress user roles (such as Administrator, Editor, or Author) to bypass the password protected screen.
Centralized Password Generator & Manager: Create, edit, and organize multiple unique passcodes with custom labels, notes, and active status toggles.
Partial Content Protector Shortcode: Lock specific paragraphs, download links, videos, or sections within any post or page using the [gatepass-password-protection] shortcode.
Customizable Password Protected Screen: Personalize your lock screen with custom logos, background colors, custom card opacity, and tailored messaging.
Cookie & Session Lifetime Management: Control cookie expiration duration (e.g. 7 days, 24 hours, or browser-session only), and invalidate all active sessions with a single click.
SEO-Friendly Search Engine Blocking: Automatically sends noindex, nofollow, noarchive HTTP response headers to keep Googlebot and search crawlers from indexing private content.

🔒 Popular Use Cases

Staging & Development Websites: Keep unfinished sites hidden from search engine crawlers, competitors, and the public while you build.
Client Work & Design Proofing: Share draft mockups, staging previews, or client presentations via password or one-click Magic Link.
WooCommerce Wholesale & Private Stores: Protect private B2B wholesale pricing and products from non-registered or public visitors.
Under Construction & Coming Soon Pages: Restrict site-wide access during maintenance or website revamps while administrators work freely.
Internal Company Intranets: Secure company handbooks, training materials, onboarding SOPs, and internal resources.
Gated Content & Lead Magnets: Lock premium guides, download links, or tutorials and share passcodes with subscribers.

🎨 Fully Customizable Password Gate Screen

Create a seamless, branded experience for your visitors instead of a generic browser prompt:
* Custom Logo Upload: Display your company or project logo directly on the lock screen.
* Customizable Typography & Headings: Tailor the headline and instructional description to match your brand voice.
* Color Palette Styling: Choose custom primary accent colors, card background colors, borders, and text colors.
* Container Opacity: Adjust container transparency to blend elegantly with your theme design.

🔌 Seamless Page Builder & Plugin Compatibility

GatePass works smoothly out of the box with all modern WordPress page builders, themes, and plugins:
* Block Editor (Gutenberg)
* Elementor & Elementor Pro
* Divi Builder
* Beaver Builder
* WPBakery Page Builder
* WooCommerce
* Major Caching Solutions: Compatible with WP Rocket, LiteSpeed Cache, W3 Total Cache, and WP Super Cache.

🚀 Free Features Included

Sitewide Password Protection: Instantly lock your entire WordPress website behind a single secure passcode screen with a single toggle. Ideal for staging environments, client proofing, development portals, or private company intranets.
Global Post Type Protection: Selectively protect entire post types with one click. Lock all standard Posts, Pages, or custom post types (portfolios, documentation, case studies) and WooCommerce products without configuring each page manually.
Centralized Password Management: Create, edit, and organize all your site passcodes from a unified, modern dashboard with custom labels, administrative notes, and active status toggles.
Magic Access Links (Passwordless Bypass): Generate encrypted one-click bypass URLs. Share direct links with clients, stakeholders, or team members so they can instantly access protected content without typing or remembering passwords.
Role-Based Whitelist Bypass: Select specific WordPress user roles (such as Administrator, Editor, Author) that automatically bypass password screens when logged in, eliminating friction for your internal team.
Customizable Password Gate Screen (Login Customizer): Brand your lock screen to match your website identity. Upload a custom logo, set custom headline text and instructions, and customize accent colors, card background colors, borders, and card opacity.
Partial Content Lock Shortcode: Protect sensitive sections, paragraphs, videos, or download links within any public post or page using the [gatepass-password-protection] shortcode. Only visitors with the correct password can view the hidden content.
Session Lifetime & Cookie Controls: Configure how long unlocked sessions remain valid (e.g. 24 hours, 7 days, 30 days, or browser session only). Includes an instant “Invalidate All Sessions” tool to force-logout all visitors immediately by rotating cryptographic salts.
Search Engine Bot Blocker: Protects your staging and private sites from search indexation by automatically dispatching noindex, nofollow, noarchive HTTP response headers and meta robots tags to Googlebot, Bing, and other crawlers.
Page Builder & Caching Compatibility: Works out-of-the-box with Gutenberg Block Editor, Elementor, Divi, Beaver Builder, WPBakery, and major caching plugins (WP Rocket, LiteSpeed Cache, W3 Total Cache, WP Super Cache).

👑 Premium Features (GatePass Pro)

Need even deeper access control and security automation? Upgrade to GatePass Pro to unlock:

Passcode Expiration Schedules (Temporary Access): Create temporary passwords that expire automatically after a set duration (1 Hour, 24 Hours, 7 Days, 30 Days) or at an exact future date and time. Ideal for time-limited client reviews, promotional access, and embargoed press previews.
Multiple Unique Passwords & Scoping: Generate unlimited unique passcodes with independent scopes. Assign different passwords to individual clients, marketing campaigns, or team departments so you can revoke one without affecting others.
Blurred Content Teaser Overlays: Pique visitor interest by showing a beautiful, customizable blurred preview of the protected content behind partial locks. Proven to boost user curiosity and conversion rates for premium articles and courses.
Public Bypass Exclusions: Enable sitewide password protection while keeping specific public landing pages, blog posts, contact pages, terms of service, or pricing tables open to everyone.
Granular Post, Page & Product Protection: Protect specific individual posts, pages, or WooCommerce products by ID without locking the entire post type globally.
Granular Category & Taxonomy Protection: Password-protect specific blog categories, post tags, or WooCommerce product categories with dedicated passcodes.
Geo-Location & Country Access Filtering: Restrict access or require passwords based on visitor country (248 ISO countries supported). Integrated with Cloudflare CF-IPCountry headers and IPinfo.io Geo-IP lookup.
IP Address Whitelisting & CIDR Subnets: Whitelist individual IPv4/IPv6 addresses or CIDR IP ranges (e.g. 192.168.1.0/24) so your office, agency team, or client headquarters bypass passwords automatically.
Anti-Spam & Bot Protection (reCAPTCHA & Turnstile): Protect your password lock screen against automated brute-force attacks and bots with Google reCAPTCHA v2 and Cloudflare Turnstile integration.
Visitor Password Requests Modal & Dashboard: Display an “Ask for Password” / “Request Access” button on the lock screen. Visitors can request access by submitting their name and email, which admins can review, approve, reject, or delete via AJAX in an integrated dashboard with automated email notifications.
Destination-Restricted & Usage-Limited Magic Links: Restrict bypass links strictly to a single target URL and set maximum usage limits (e.g., 1 to 100 clicks) before the link automatically invalidates.
Detailed Access Logs & Analytics: Monitor visitor unlock events, track password usage frequency, and maintain an audit trail of access across your site.

🌐 Third-Party External Services Disclosure

This plugin (and its optional extensions) connects to the following external third-party services:

Freemius SDK (Software Licensing, Updates & Diagnostics)

* What it does: Provides optional opt-in usage diagnostics, automated security/feature updates, and premium license activation.
* Service URL: https://freemius.com
* Terms of Service: https://freemius.com/terms/
* Privacy Policy: https://freemius.com/privacy/
* Data Transmitted: Only transmitted when the user explicitly clicks “Allow” on the opt-in screen or activates a license key. Data sent includes site URL, WordPress version, PHP version, plugin version, and administrator email address. No visitor passwords or sensitive site content are ever transmitted.

Google reCAPTCHA v2 (Anti-Spam Bot Protection – Optional)

* What it does: Protects the password login gate screen against automated brute-force attacks and spam bots.
* Service URL: https://www.google.com/recaptcha
* Terms of Service: https://policies.google.com/terms
* Privacy Policy: https://policies.google.com/privacy
* Data Transmitted: Only loaded when the site administrator enables Google reCAPTCHA and enters their API keys. The visitor’s browser loads Google’s script (https://www.google.com/recaptcha/api.js), and their verification response token along with visitor IP address is verified against Google’s API endpoint (https://www.google.com/recaptcha/api/siteverify).

Cloudflare Turnstile (Privacy-Preserving Bot Protection – Optional)

* What it does: Delivers smart, privacy-first bot detection to prevent automated brute-force attempts on the password gate.
* Service URL: https://www.cloudflare.com/products/turnstile/
* Terms of Service: https://www.cloudflare.com/website-terms/
* Privacy Policy: https://www.cloudflare.com/privacypolicy/
* Data Transmitted: Only loaded when the site administrator enables Cloudflare Turnstile and configures their API keys. The visitor’s browser loads Cloudflare’s script (https://challenges.cloudflare.com/turnstile/v0/api.js), and the challenge token and visitor IP address are verified via Cloudflare’s API endpoint (https://challenges.cloudflare.com/turnstile/v0/siteverify).

IPinfo.io (Geo-IP Location Detection – Optional)

* What it does: Resolves visitor IP addresses to two-letter ISO country codes to enforce country-based access protection rules when server-level Geo-IP headers (such as Cloudflare CF-IPCountry) are unavailable.
* Service URL: https://ipinfo.io
* Terms of Service: https://ipinfo.io/terms-of-service
* Privacy Policy: https://ipinfo.io/privacy-policy
* Data Transmitted: When Geo Protection rules are active and no server-level country header exists, the visitor’s public IP address is queried via a secure server-to-server request (https://ipinfo.io/{ip}/json). Results are cached locally in WordPress transients for 24 hours to prevent repeated external requests.

GatePass – Password Protect Pages, Posts, Entire Site & WooCommerce for WordPress

About this plugin