Wolf Designs  ·  WordPress privacy plugin *

The password wall for WordPress that actually locks everything.

Pages. Images. Uploads. Feeds. Admin. One lock. One key.

Wolf Password Gate puts your whole WordPress site behind a branded password screen. Visitors enter a valid named password to get through. If you’re already logged into WordPress, you go straight to work.

Get in touch about Wolf Password Gate
See what the gate protects

One site-wide gate  ·  Individual named passwords  ·  Automatic WordPress admin bypass

One gate. The whole site.

Keep the side doors closed

✓ Front-end pages and posts

✓ Images, PDFs and uploads

✓ Feeds, REST API, XML-RPC and sitemaps

✓ wp-admin and wp-login

Logged-in WordPress users bypass the gate automatically. Everyone else sees your password screen.

More than a page prompt
Protect files and site endpoints too

Access you can manage
Name, enable or disable passwords individually

Your site, your screen
Brand the gate instead of advertising a plugin

A password screen isn’t the same as a private site

Some site-password tools guard the page people see, but leave the files and feeds behind it exposed.

The page is locked. The file isn’t.

A direct image or PDF URL can still be reachable even when the page that links to it asks for a password.

The side doors are still open

Feeds, REST endpoints and sitemaps can reveal more than a password-protected home page suggests.

Your own login gets in the way

Some gates ask site owners to enter a second, shared password after they have already logged into WordPress.

The whole site goes behind the gate

Wolf Password Gate protects the parts of WordPress that a page-only password prompt can miss.

Pages and posts

Front-end pages and posts stay behind the password screen until a visitor enters a valid password.

Uploads and direct links

Images, PDFs and other files in the WordPress uploads folder are protected, including when someone has the direct URL.

Feeds and endpoints

Feeds, REST API, XML-RPC and sitemaps are included in the site-wide protection.

WordPress admin routes

wp-admin and wp-login.php are covered. Logged-in WordPress users bypass the site gate automatically.

Protect the upload itself — not just the page that links to it

When someone guesses or shares a direct media URL, the file should not become a back door around your password screen.

On Apache and LiteSpeed, Wolf Password Gate blocks the uploads folder at the server with .htaccess. On other server setups, a PHP fallback applies the same protection.

A visitor who reaches a protected file directly receives a 403 Forbidden response instead of the file.

Direct URL protection

Close the window, not only the front door

That means a private gallery, a draft client PDF or a family photo does not rely on visitors failing to guess its file address.

The result: one coherent gate across the site, including direct requests to protected uploads.

Access controls that make sense day to day

A site-wide gate should be simple for visitors and manageable for the person running the site.

Multiple named passwords

Create separate entries such as “Family”, “Client review” or “March access”. Disable one password when access should end; leave everyone else’s password working.

One WordPress login for admins

Already signed into WordPress? The gate recognises logged-in users and lets them through automatically. No second shared-password prompt.

Smart lockouts

Limit incorrect guesses with configurable attempt and lockout settings. Visitors see a live countdown while locked out.

A readable activity log

Review failed attempts and active lockouts from the Dashboard, with passwords masked by default so a typo does not leave a near-match exposed.

Optional context and alerts

Use optional IP location lookup and choose whether to receive an email when an IP address is locked out.

Control stays in your hands

Disable or delete a password when it is no longer needed. Its sessions expire on the next request.

Give access by name. Take it away by name.

A shared site password is hard to manage once it has travelled through a family, a client team or a project group.

Wolf Password Gate lets you create multiple named passwords, so you can tell “Family” apart from “Client preview” or “Contractor access”. When one person no longer needs entry, disable that password rather than changing the key for everyone.

Reminder dates—not surprise lockouts

Add optional reminder dates to a password. The admin can show “due soon” and “overdue” badges to make access reviews easier.

The date is a reminder, not an automatic expiry. A password is not silently switched off just because a reminder date passes; you decide when to disable it.

A lockout visitors understand. A log you can use.

Protect the password form from repeated guesses without turning troubleshooting into guesswork.

Configurable limits with a live countdown

  • Default limit: 5 incorrect attempts.
  • Default lockout: 15 minutes. Change both settings to suit the site.
  • A live countdown shows visitors when the form will be available again.
  • Refreshing an error screen does not count as another attempt.

Useful records, without plain-text guesses

Failed attempts and active lockouts appear on the Dashboard. Password guesses in the log are masked by default—for example, only a partial hint and character count are shown.

When useful, enable optional IP location lookup or email alerts for a locked-out IP. These controls are optional.

Your site. Your screen.

Make the gate look like it belongs

Visitors see your site’s identity, not a plugin advertisement. Customise the login screen with your own:

  • Logo, heading and message
  • Footer and button label
  • Background and button colour
  • Additional colour overrides, if you want them

Leave the colours alone and the plugin chooses readable contrast for you.

A calm, branded front door

Use the message to tell invited visitors what the site is for, how to enter, or who to contact if they need access.

The form stays focused on one job: let an invited visitor enter a valid password and continue.

Keep a few things public—on purpose

Some sites need a public preview image or a callback URL. Add deliberate exceptions without turning off the gate for everything else.

Public Media Whitelist

Choose up to 20 images from the Media Library to remain public. Every WordPress-generated size of each selected image is included, which can help an email header or social preview load while the rest of the site stays private.

URL Whitelist

Add up to 10 URL paths for payment webhooks or other callbacks that must reach the site while the rest remains locked.

Boundaries: the site root, wp-admin and wp-login cannot be whitelisted. Those paths would undermine the gate.

Built like a lock, not a banner

The access screen is only one part of a private site. The gate also takes care with password storage, sessions and search visibility.

Password and session handling

  • Passwords are stored using WordPress wp_hash_password hashes, never as plain text.
  • Sessions use HMAC-signed cookies with HttpOnly and SameSite=Lax.
  • The cookie is marked Secure when the site uses HTTPS.
  • Enable Force HTTPS when you want the site gate to require an encrypted connection.

Search visibility and control

  • Search engines are discouraged with noindex and a robots.txt override.
  • Disable or delete a password and its sessions end on the next request.
  • Contextual “?” help on settings screens explains the controls as you use them.

These are practical privacy controls for a password-gated site—not a replacement for every layer of security.

Who Wolf Password Gate is built for

If the job is “keep this WordPress site private”, start here.

Family sites

Share photos, videos and stories with people you actually know—without leaving direct file URLs open.

Client work in progress

Show a draft or staging site to a client before it is ready for the public or search engines.

Photographer galleries

Give a client a named password for a shoot, then disable that entry when the review period is over.

Team wikis and internal docs

Put staff-only resources behind a shared site gate when you do not need individual WordPress accounts for every reader.

Staging and coming-soon sites

Keep the public out while you build, revise or prepare to launch.

A clear, simple privacy gate

Use the plugin when site-wide password access is the job—not when you need a membership platform or a full security suite.

A clearer comparison

No brand fight. Just the practical difference between a page prompt and a site-wide gate.

  • What you need
  • Lock the pages
  • Lock images, PDFs and uploads
  • Protect feeds, REST, XML-RPC and sitemaps
  • WordPress admins already logged in
  • More than one password
  • Brand the login screen
  • Repeated incorrect guesses
  • End one person’s access
  • Typical site-password tools
  • Yes
  • Often no—direct URLs may still work
  • Coverage varies
  • May be asked for the site password again
  • Often one shared code
  • May show plugin branding or generic forms
  • Basic or no lockout controls
  • May require a shared-password reset
  • Wolf Password Gate
  • Yes
  • Yes—direct file requests are protected
  • Included in the gate
  • Automatic bypass
  • Named passwords; revoke one at a time
  • Use your logo, wording and colours
  • Configurable lockout and live countdown
  • Disable one named password

Capabilities differ between plugins. The comparison describes common patterns, not a claim about every product.

Know what it is—and what it isn’t

The right tool depends on the job. Wolf Password Gate is deliberately focused on site-wide password access.

It is a good fit if you need

  • One site-wide password gate for invited visitors.
  • Protection for pages, uploads and site endpoints—not only the visible page.
  • Named passwords you can manage individually.
  • A branded login screen and practical lockout controls.

It is not a replacement for

  • A membership plugin: it has no billing, paid tiers or per-user profiles.
  • Two-factor authentication or a web application firewall.
  • Controls over what a logged-in visitor can screenshot or copy.
  • A secure WordPress setup, backups or other site security practices.

Getting started takes about 90 seconds

No second login for administrators. No complicated setup flow.

1. Install

Install and activate Wolf Password Gate.

2. Add a password

Create a password and give it a label that makes sense to you.

3. Turn on the gate

Enable site protection when you are ready to keep the public out.

4. Test privately

Open the site in a private browser window and confirm that the gate is working.

Frequently asked questions

A few practical details before you put a site behind the gate.

Does it protect direct image and PDF links?

Yes. On Apache and LiteSpeed, the uploads folder is blocked at the server. Other server setups use a PHP fallback. A direct request to a protected file returns 403 Forbidden.

Will I need to enter the site password after logging into WordPress?

No. Logged-in WordPress users bypass the gate automatically.

Can I give different people different passwords?

Yes. Create multiple named passwords and disable one entry without resetting access for everyone else.

What are the default lockout settings?

The default is 5 incorrect attempts followed by a 15-minute lockout. Both settings are configurable, and the visitor sees a live countdown.

Does the activity log store the password someone typed?

Guesses are masked by default. Failed attempts and active lockouts are available from the Dashboard.

Can I set reminder dates for passwords?

Yes. Reminder dates show “due soon” and “overdue” badges, but passing a reminder date does not automatically disable that password.

Can I keep a few images or URLs public?

Yes. The Public Media Whitelist accepts up to 20 Media Library images, including their generated sizes. The URL Whitelist accepts up to 10 paths for callbacks that must reach the site. The root, wp-admin and wp-login cannot be whitelisted.

Can I use my own branding on the gate?

Yes. Set your logo, heading, message, footer, button label, background and button colour. Add colour overrides if you want them, or leave colours alone for automatic readable contrast.

Does it block search engines?

The plugin adds a noindex instruction and overrides robots.txt. Search engines are discouraged from indexing the gated site.

How are passwords and sessions handled?

Passwords use WordPress password hashes. Sessions use HMAC-signed cookies with HttpOnly and SameSite=Lax; the Secure flag is used on HTTPS sites.

Is it a membership plugin or a firewall?

No. It does not provide billing, paid membership tiers, per-user profiles, two-factor authentication or a web application firewall.

Can it stop a logged-in visitor taking a screenshot?

No. A site gate controls access to the site; it cannot stop someone who is already authorised from capturing what they can see.

Built by Wolf Designs

Handcrafted. Documented. Actually maintained.

Wolf Password Gate is a professional tool for people who want a private WordPress site to be private—without the usual compromises.

Visitors see your site’s identity. You stay in control of who can enter.

Focused on one job

Make the site private, protect direct files, let WordPress admins work normally and keep individual passwords manageable.

Wolf Password Gate  ·  Wolf Designs  ·  Version 0.5.1

Ready to lock it down?

Keep pages, files, feeds and admin routes behind one branded password gate—with named access you can manage.

© 2010-2018, Quick Link Designs.