PrimePlaced – Advanced password protection lets WordPress site owners password protect an entire site in under a minute. Set one password, switch protection on, and every visitor sees a branded lock screen before they can reach your content. No user accounts, no membership system, no coding.

Use it to keep a staging or development site closed, share a private preview with a client, run a private blog or internal site, or keep a site hidden during a migration. Once the correct password is entered, access is remembered for the current browser session or for the number of days you choose.

Core features

Site-wide password protection with one primary password.
Customizable lock screen: logo, background colors, heading, field labels, button text, and error message.
Live design preview in the admin area.
Session access or access remembered for a chosen number of days.
Protection status widget on the WordPress dashboard.
Cache-busting headers and built-in handling for LiteSpeed Cache and W3 Total Cache.
Built-in throttling of repeated password attempts.

Protection model

PrimePlaced – Advanced password protection is designed so that protected content does not leak around the lock screen. When site-wide protection is on, the WordPress REST API and feeds are protected as well as regular pages, and authenticated pages are not stored as public cache entries.

The lock screen is served with a noindex, nofollow robots tag, so search engines stay out. Saved passwords are stored encrypted in your WordPress database, and the password screen is built with semantic landmarks, readable contrast, and full keyboard support.

Pro features

An optional paid Pro version is available separately. The free plugin is fully functional on its own and does not contain locked features.

Pro areas include multiple passwords, scheduled password activation and expiration, protection for individual posts, pages, WooCommerce products, categories, custom post types, and taxonomies, Gutenberg and classic editor integrations, password form blocks and lock screen templates, role and IP bypass, remember-me controls, Google reCAPTCHA v2/v3, activity logs, statistics, and import/export tools.

External services

This plugin uses the Freemius SDK, a service provided by Freemius, Inc., for opt-in usage diagnostics, account and license management, and the optional upgrade flow. Site passwords and visitor data are never sent to Freemius.

The plugin contacts Freemius (api.freemius.com, wp.freemius.com, checkout.freemius.com) only in these cases:

After an administrator opts in on the plugin’s welcome screen: the administrator’s name and email address; the site’s homepage URL and title, WordPress and PHP versions, and site language; the plugin and SDK versions and whether the plugin is active, deactivated, or uninstalled. If the administrator also allows it, the names, slugs, versions, and active status of installed plugins and themes are sent. Opting in is optional, and the administrator can skip it or change permissions later from the plugin’s Account page.
When an administrator submits deactivation feedback: the selected reason and any text entered.
When an administrator opens the Pricing page or starts checkout: plan and pricing data are loaded from Freemius, and the information entered during checkout is sent to Freemius to process the purchase.

If the administrator does not opt in and does not use these screens, no data is sent to Freemius.

Freemius terms of service: https://freemius.com/terms/
Freemius privacy policy: https://freemius.com/privacy/

Google reCAPTCHA (Pro only) is used only when a site administrator configures and enables the Pro reCAPTCHA module on password forms. Depending on the configured version, Google may receive information such as the visitor’s IP address and browser/device data.

Google terms of service: https://policies.google.com/terms
Google privacy policy: https://policies.google.com/privacy

Privacy

PrimePlaced – Advanced password protection stores its settings locally in your WordPress database and sets one functional cookie for authorized visitors.

Core data stored by the plugin may include:

Plugin settings, including the encrypted site password and lock screen customization.
A functional cookie in the visitor’s browser holding the temporary authentication token. It lasts for the current browser session or for the number of days selected by the administrator.
Short-lived counters used to throttle repeated password attempts. They are keyed by a hash derived from the visitor’s IP address; the raw IP address is not stored.

Core data intentionally excludes:

Visitor accounts, names, or email addresses.
Activity logs of visitor access.

If the Pro activity log is enabled, the IP address, browser User-Agent string, timestamp, and result (successful, failed, or blocked) of authentication attempts are stored in a dedicated table in your own WordPress database.