Publish a finished wedding gallery on your site and it’s public by default. Anyone who lands on the page, or finds it through search, can scroll the whole set.
The only people who should see that set are the bride and groom, and the same goes for most client work. Wedding galleries, newborn sessions, and boudoir shoots aren’t portfolio pieces you want indexed.
WordPress already solves this, and no extra plugin is involved. To password protect a WordPress gallery, you use the password field built into the page editor. It takes under a minute.
I’ve used it on client galleries for years. It works well, as long as you know exactly what it protects and what it leaves open.
In This Article
- When a Photo Gallery Needs a Password
- How to Password Protect a Gallery Page in WordPress
- What Visitors See on a Password Protected Gallery Page
- How to Keep Password Protected Galleries Out of Your Blog Feed
- Where WordPress Password Protection Falls Short for Photographers
- Ways to Protect Your Photos Beyond a Password
- How to Deliver Client Galleries With Imagely Proofing
- Frequently Asked Questions About Password Protecting a WordPress Gallery
- Can you password protect a single gallery instead of the whole page?
- Does Imagely have a password protection feature?
- Can you give each client a different password?
- How long does a password protected page stay unlocked?
- Do password protected galleries show up in Google?
- Is a password protected page the same as a private page?
- Can a client still download the photos from a protected gallery?
When a Photo Gallery Needs a Password
Most galleries on a photography site are meant to be seen. Portfolio pages and print shop galleries work harder when they’re public.
Client work is the exception. These are the situations where a password earns its place:
- Wedding and event galleries meant for the couple and nobody else.
- Newborn, maternity, and boudoir sessions where the client expects privacy by default.
- Proof galleries where the client picks favorites before you deliver the finals.
- Commercial shoots under an NDA, or under embargo until a campaign launches.
- A private portfolio you send to one prospect, with your pricing attached.
The common thread is a small, known audience you can hand a password to.
How to Password Protect a Gallery Page in WordPress
Build the gallery as you normally would, on its own page or post. The password lives on the page rather than inside the gallery, so the gallery needs no special setup.
With that page open in the block editor, look at the settings sidebar and find Status. Next to it is a link showing the current state, either Draft or Published.
Click that link. A pop-over titled Status & visibility opens, listing every option WordPress gives you for who can see this page.
Tick the Password protected checkbox, captioned “Only visible to those who know the password.” A PASSWORD field appears underneath. Type the password you plan to give your client, close the pop-over, and save.
Private, sitting right there in the same panel, is not a quieter version of a password.
Password protected means anyone holding the password can open the page. Private is captioned “Only visible to site admins and editors,” which locks your client out along with everyone else.
WordPress covers the rest of the panel in its documentation on the page and post settings sidebar.
What Visitors See on a Password Protected Gallery Page
Until the password goes in, the page your client lands on looks nothing like your gallery.
WordPress swaps the whole content area for a short form: a line saying the page is protected, one password box, and a button.
The page title and URL stay visible above that form, so keep a client’s full name out of both.
Once the password is accepted, the gallery loads normally, lightbox and all. The unlock is remembered in the browser, so your client isn’t retyping it every visit.
How to Keep Password Protected Galleries Out of Your Blog Feed
Build the gallery as a post rather than a page and WordPress treats it like any other post. It shows up in your recent posts widget, your blog archive, your category pages, and your feed.
The photos stay locked. The listing doesn’t, so visitors see a protected entry in your feed under whatever title you gave it.
The simplest fix is to build client galleries as pages instead of posts. Pages never appear in the blog feed, and the password behaves identically.
Already built your client galleries as posts? A small code snippet can pull them out of your listings. Here’s the snippet and where to put it!
Either route gets the same outcome: reachable by link and password, invisible to everyone browsing your site.
Where WordPress Password Protection Falls Short for Photographers
The page password is the right tool for one gallery and one client. It was never built as a client delivery system, and the gaps show up fast once you’re running several galleries.
Here’s what it doesn’t do:
- One page holds one password. Everyone with that link shares it, and per-client passwords need code.
- Passwords do not expire. Nothing closes the gallery after two weeks unless you change it yourself.
- The unlock lasts ten days by default, set by the
post_password_expiresfilter. Shortening it takes code. - Any other editor or administrator on your site can open the page without the password. It is not a lock against your own team.
- It protects the page, not the files. The images stay reachable at their direct
/wp-content/uploads/URLs for anyone holding a link.
That last point matters most, and it’s why a password is a starting point rather than a finish line.
The password stops at the page, not at the file
A password gate controls who reaches your gallery page. It does nothing to the image files sitting behind it. Anyone with a direct file URL can open that image without ever seeing the password form, so assume the files can travel before you deliver a set you would not want copied.
Ways to Protect Your Photos Beyond a Password
Since the password stops at the page, the next layer has to work on the images. Three settings handle most of that, and they all sit inside your gallery plugin.
Imagely is a WordPress gallery plugin built for photographers, and all three live under Imagely > Settings in your admin menu.
Watermarking is the honest answer to file-level copying, and it’s free on every plan, Lite included. Open the Watermarks tab, add a text watermark or your logo, then set position, offsets, size, opacity, and color.
A watermark travels with the file, so your name goes along even if someone pulls the image straight from your uploads folder. Our watermarking guide compares the free, Pro, and desktop routes.
Image protection disables right-click and drag-to-save on your galleries. It’s worth switching on, as long as you treat it as a speed bump rather than a lock.
Imagely’s own documentation is blunt about the ceiling: “any web-savvy individual can take a screenshot of your image or find the source code.”
User roles and permissions set the lowest WordPress role allowed to use each gallery capability. It’s free too, and widely misread: it governs who on your team can manage galleries, not who among your clients can view one.
Layered together, these three narrow the file-level risk that a page password leaves wide open.
How to Deliver Client Galleries With Imagely Proofing
A password answers one question: who gets in. It does nothing for what comes next, when your client has to tell you which twelve photos they want.
Imagely’s client proofing, available on Pro and Ultra, moves that conversation into the gallery itself. Clients star their favorites in the Pro Lightbox and submit the selection with a name and email.
Setup has two halves. Under Imagely > Settings, open Lightbox Effects and choose the Pro Lightbox, since proofing runs inside it.
Then on the gallery’s Customize tab, turn on Enable proofing and set Display Triggers to Always. Skip that last setting and the Submit Proofs button never shows up.
Submissions arrive under Imagely > eCommerce > Proofing, where you can see what each client picked. Imagely’s proofing documentation covers each option in detail.
Add the page password from earlier and you have a password-protected proofing gallery, which is what most client delivery actually needs.
Deliver client galleries without the extra apps
Watermarking, image protection, and client proofing in one photography-focused WordPress plugin.
Frequently Asked Questions About Password Protecting a WordPress Gallery
Can you password protect a single gallery instead of the whole page?
Not with WordPress’s built-in option. The password applies to the whole page or post, so everything on it unlocks together. If you need two galleries with different passwords, put each one on its own page.
Does Imagely have a password protection feature?
Not a separate setting inside the plugin, and it doesn’t need one. Imagely relies on WordPress’s own page-level password, which covers every gallery and everything else on that page. Its own documentation confirms this is the supported way to protect a gallery.
Can you give each client a different password?
Not on the same page. One page holds one password, so every client who receives that link uses the same one. The practical workaround is a separate page per client.
How long does a password protected page stay unlocked?
Ten days by default. WordPress stores the unlock in the visitor’s browser, and the lifetime is controlled by the post_password_expires filter. Changing that window takes a small code snippet.
Do password protected galleries show up in Google?
The page itself can still be indexed, but the photos behind the password cannot be crawled. Search engines see the password form, not your gallery, so nothing from the set can rank on its own.
Is a password protected page the same as a private page?
No. Password protected means anyone holding the password can view the page. Private means only logged-in administrators and editors on your site can see it, which shuts your clients out too.
Can a client still download the photos from a protected gallery?
Yes, once they’re past the password. The password controls who reaches the page, not the image files, which stay reachable at their direct URLs to anyone holding a link. That gap is exactly why watermarking exists.
A page password is a small setting that solves a real problem, and it’s worth applying to every client gallery you publish. Once it’s locked, the next job is getting selections back, and our online proofing walkthrough covers that half of the workflow.
Don’t have Imagely yet? Get started today!
For more photography tips and WordPress tutorials, check out our blog.
Hello we have galleries on our site which now glitch when entering the password, sometimes the password takes you to the gallery and at times it just stays at the password screen. We use the free version and current version.
You’re welcome to contact support if you need assistance. Note that the password protection feature is part of WordPress, not NextGEN Gallery.
Would be nice to lock a gallery, much less programming works 😉
You’re welcome to request that via support.
Ok but what if i want one page with 10 gallerys and each of them protected with there single different password!?
How can I do that?
Thanks
You would create 10 pages with password protection and link each gallery to those pages.
So there is no way to password protect individual galleries? That was the whole purpose I bought this plug in. UGH. A waste of $99
Hi Jessica,
There was no reason to recreate what WordPress already offers, so utilizing the built-in password protection feature does the same thing as if we had built our own password protection feature. With that said, NextGEN does allow for password protected galleries 🙂
Hello, Thank you for the product. As a school portrait photographer, individual passwords are essential to each gallery to prevent access to student’s pictures from lurking individuals. Links and keys are emailed to parents individually for their kid’s gallery access. If we can’t lock them, maybe obscure/random urls to galleries alone, where those urls can be emailed individually.
Thanks!
This sort of protection is not enough. If a bot finds out where the pictures are stored – and this is pretty easy when using the standard folder structure of any gallery plugin – all the pictures can be “stolen”, no matter if password protection is turned on or off. This is because the picture files and their FOLDERS are not protected at all.
NextGEN Gallery uses htaccess to protect your original images. However, you won’t find any software that protects images displayed on the front end. Yes, we also offer drag and right click protection, but anyone can look at source code on any website on any platform. This includes Squarespace, 500px and more. However, combine our security of original images, password protection, right click and drag protection and watermarking and you have a lot of control over making your images safer. But there is no guaranteed image security anywhere.
I password protected a block page, but now it says the word “Protected” in front of the title. http://www.megdarnell.com/blog/
Is there a way to remove that word “protected”?
That’s a default function of WordPress. You can install this simple plugin to remove the prefix. Or if you understand this tutorial you can do it without a plugin.