Knock First – Password Protect Your Site

Knock First makes it easy to password protect an entire WordPress website with one shared password. It is ideal for private sites, staging websites, client previews, coming-soon pages, and launches.

The plugin is disabled by default. After activation, open Settings > Site Password, choose a password, and enable protection.

Features:

• One switch protects the public-facing site.
• Passwords are stored as one-way WordPress password hashes, never as plain text.
• Access uses a signed, HTTP-only browser cookie that is invalidated when the password changes.
• Choose an access duration from one hour to 30 days.
• Optionally let logged-in WordPress users bypass the gate.
• Administrators and the standard WordPress login always remain accessible.
• Public REST API requests are protected, core XML sitemaps are disabled, and robots are asked not to index the protected site.
• The unlock screen is responsive, keyboard friendly, and uses no external services or assets.
• No tracking, advertising, remote requests, or user accounts.

Important security note

This plugin is a simple privacy gate. It is not a replacement for WordPress user accounts, server-level access control, or another security system when protecting sensitive or regulated data. Public files already uploaded to the Media Library may remain reachable by their direct URLs, and another plugin can expose data through its own custom endpoints.