--- title: "How to password protect a page on Shopify | Inner Circle" description: "Shopify has no per-page password, so here are the three things people mean by it, how to build each one, and which of them is real protection." source: https://innercircle.monochrome.digital/guides/password-protect-a-shopify-page/ --- [Home](https://innercircle.monochrome.digital/) [Guides](https://innercircle.monochrome.digital/guides/) How to password protect a page on Shopify # How to password protect a page on Shopify Shopify has no per-page password, so here are the three things people mean by it, how to build each one, and which of them is real protection. By [Monochrome](https://innercircle.monochrome.digital/about/) · Last updated 13 August 2026 ## On this page 1. [The three things people mean](#the-three-things-people-mean) 2. [Why the built-in feature is not it](#why-the-built-in-feature-is-not-it) 3. [Option 1: hide the page](#option-1-hide-the-page) 4. [Option 2: a login gate in the theme](#option-2-a-login-gate-in-the-theme) 5. [Option 3: an access app](#option-3-an-access-app) 6. [The part that is not negotiable](#the-part-that-is-not-negotiable) 7. [Choosing](#choosing) Shopify has no setting that password protects a single page. The password page in your admin is one switch for the entire storefront: all of it or none of it, with nothing in between. That is usually a surprise, and it is usually not the end of the problem, because "password protect this page" turns out to mean three different things depending on who is asking. They need three different builds. Sorting out which one you want is most of the work. ## The three things people mean **A shared passcode.** One word or phrase you hand out, that anyone holding it can type in. Like a door code at a members' club: the code is the credential, and it does not know who used it. **A login.** The page is visible to particular customers and nobody else. Not a password so much as an account, plus a rule about which accounts qualify. **A link nobody else has.** No credential at all. The page simply is not linked from anywhere and its URL is not guessable. People say "password" for all three. Get this wrong and you build a login system for someone who wanted to text a code to forty people, or hand out a shared passcode where you needed to know who came in. ## Why the built-in feature is not it Shopify's password page lives under **Online Store → Preferences → Restrict store access**, and it is genuinely good at what it does. It is also all-or- nothing: turn it on and every product, collection and page goes behind one password, including for Google. There is no per-page version, no per-collection version, and no theme edit that adds one, because the check happens before your theme runs. You cannot reach it from Liquid. If the whole store *should* be shut, because you are pre-launch or genuinely closed, that is the right tool and it is free. We wrote about [when the password page is the right answer and when it is not](https://innercircle.monochrome.digital/guides/shopify-password-page-alternative/) separately. For one page, you need something else. ## Option 1: hide the page The simplest thing, and worth knowing before you install anything. Every page in **Online Store → Pages** has a visibility setting. Set it to Hidden and the page stops being publicly reachable. It returns a 404 to anyone who asks, including you when logged out. That is not protection with a credential, it is an off switch. There is no way to let a chosen person in, because there is nothing to let them in *with*. It is the right answer for a page you want gone for now and back later, and the wrong one for anything you want a specific person to see. The related trick, leaving a page visible and unlinked with a URL nobody would guess, is the third meaning above, and it is worth being honest about what it gives you. The URL will leak. Someone will forward it, paste it in a Slack, or land on it from a browser extension that phones home. Unlisted is fine for a page that would merely be *untidy* to have found. It is not fine for anything that matters. ## Option 2: a login gate in the theme If what you want is "customers I have approved can see this page", you can build it yourself with a custom page template and no app at all. Create a template called `page.private.liquid` and assign it to the page in the admin: ```liquid {% if customer and customer.tags contains 'approved' %} {{ page.content }} {% else %}

This page is private

Log in to view it.

{% endif %} ``` Tag the customers who should get in, and you are done. Liquid runs on Shopify's servers, so the content never reaches an unapproved browser. This is a real gate, not hidden markup. Its limits are the ones that eventually bring people to apps: - **It is one page.** Every page you add this to is another template to assign and another place the rule lives. - **It only covers the page.** If the page lists products, those products are still reachable at their own URLs, still in your collections, still in search results and still in your sitemap. - **Anyone can register.** An account is not an approval, so you need a process for who gets the tag, and that process is you, reading email. - **There is no code to hand out.** This is a login, not a passcode. If your actual plan was to give one phrase to a mailing list, this does not do it. ## Option 3: an access app Apps in this category do the thing Shopify does not: apply a lock per page, per collection or per product, and give you credentials to hand out (passcodes, customer tags, email lists, secret links) while the rest of the store carries on normally. This is the only option that covers the shared-passcode case properly, and the only one where the lock follows the *content* rather than one template. Two things worth asking before you install any of them, ours included. **Does the content flash?** The lazy implementation hides things with JavaScript once the page has already loaded, which means it was visible for a moment and is still sitting in the page source. Ask how it works. You want a decision made before the theme paints, not a tidy-up afterwards. **What happens during their outage?** Fail closed and your page breaks while they are down; fail open and it becomes visible. Both are defensible. Not knowing which one you bought is not. [Inner Circle](https://innercircle.monochrome.digital/how-it-works/) fails open after four seconds, on purpose, because our outage must not take your store down. That does mean a gated page can become readable during one. That trade is why we call it a merchandising control rather than security, and it is the same trade every app in the category is making whether or not they say so. All of them are compared properly in [Shopify access control apps, compared](https://innercircle.monochrome.digital/guides/shopify-access-control-apps-compared/). ## The part that is not negotiable **None of this is security, including the app version.** A determined visitor with developer tools can make hidden things reappear in any browser-side design. So the question to ask is never "can the page be revealed". It is **"can someone who was not approved actually buy, or download, or submit"**, and that decision has to be made on a server. If your private page is private because of styling, you have a curtain, not a lock. If the page holds something that would genuinely harm you to leak (pricing contracts, unreleased financials, personal data), none of the options on this page are the right shape. Put it behind a real account system somewhere that is not a storefront. ## Choosing - **Gone for now, back later** → hide the page. No app, no template, ten seconds. - **Approved customers only, one or two pages** → the theme template above. - **A code you hand out, to a list or an influencer or a trade buyer** → an app. Nothing else does passcodes. - **The products on the page need locking too, not just the page** → an app. The template only ever covers the page it is on. - **The whole shop should be shut** → the built-in password page, free, and better than any of this. The honest dividing line between the second and third is how often you are handling requests. A handful a month is a tagging job you do by hand. Twenty a week is a process, and processes want software. Whichever way it lands, test the flash yourself before committing. Ours has a [free plan](https://innercircle.monochrome.digital/pricing/) with no card and no time limit, which is enough to lock one page and watch your own theme load it. ## Read next [The Shopify password page, and when it is the wrong tool](https://innercircle.monochrome.digital/guides/shopify-password-page-alternative/) [How to hide prices on Shopify](https://innercircle.monochrome.digital/guides/hide-prices-on-shopify/) [Running a private sample sale on Shopify](https://innercircle.monochrome.digital/guides/running-a-private-sample-sale/) ## Inner Circle gates prices and buy buttons for you It does the gating described above without a theme rebuild or a second store. The free plan is one lock and five codes, with no time limit and no card. [Install on Shopify](https://apps.shopify.com/inner-circle) [Watch it work first](https://innercircle.monochrome.digital/tutorial/) [Ask whether it fits your store](https://innercircle.monochrome.digital/contact/)