WP Manifestindependent plugin directory
manifest / security / cgit-wp-password-protection

Castlegate IT WP Password Protection WP Registry grade A. No security issues foundWP RegistryNo security issues foundOpen the reportA

Password protection for staging sites

★ 0stars
v1.2.2latest · 10mo ago

Install

Download source zip No release zip yet

This is the repository archive. It installs, but the folder name will carry the branch suffix and updates will not flow.

Install straight from GitHub with WP-CLI:

wp plugin install https://github.com/castlegateit/cgit-wp-password-protection/archive/refs/heads/main.zip
No built-in updater. New versions won't appear under Dashboard → Updates. Install new releases yourself, or let Git Updater track the repository.

This plugin provides simple password protection for staging sites. You can find the settings page in Settings > Password Protection. When active, the plugin provides four modes:

  1. Disabled: Access to the site is not restricted.
  2. WordPress user account: Access to the site is restricted to logged in users.
  3. Password: Access to the site is restricted to users who enter a single, common password.
  4. Password or WordPress user account: Access to the site is restricted to logged in users or users who enter a single, common password.

When the third or fourth option is selected, users will need to re-enter the common password after 24 hours.

Exceptions

Exceptions are made for a few URLs and endpoints:

  • Cron requests (wp-cron.php)
  • REST API requests (^/wp-json/*)

License

Released under the MIT License. See LICENSE for details.

Releases

6 releases.

Tag
Published
v1.2.2 latest
Dec 19, 2025 10mo ago
Sep 15, 2025 1 year ago
Sep 12, 2025 1 year ago
Sep 12, 2025 1 year ago
Sep 12, 2025 1 year ago
Sep 12, 2025 1 year ago

These releases are tags only. The author does not attach a packaged zip, so there are no download counts to report.

A grade

Security

Castlegate IT WP Password Protection 1.2.2 · audited by WP Registry

No security issues found.

Audited release
1.2.2
Findings
none
Worst severity
—
Content hash
b01d844bb69f759d5d568d37…

WP Registry hashes the installable build and reports on that exact bytes-for-bytes copy. Embargoed findings are withheld until they are disclosed, so a clean verdict means nothing public is outstanding. WP Manifest does not audit code itself.