Custom post types are useful tools for creating content on your WordPress site. They let you get new content up more quickly, and organize it more effectively. However, you won’t always want all that custom content to be visible to everyone.
There are 2 ways to protect a custom post type in WordPress. First, you can protect your custom post types with a password, so no one but approved visitors can see that content. Second, you can restrict content within specific post types to logged in users with particular roles. Both of these techniques can be applied to any post type – including the default ones that come with WordPress, content types that you create yourself, and content types added by plugins or themes.
In this guide, we’ll discuss what custom post types are and when you might want to keep them private. Then we’ll show you how to protect WordPress custom post types with the easy-to-use Password Protected Categories plugin. Let’s jump right in!
An introduction to custom post types in WordPress
First, it’s important to understand that the term ‘post type’ is a bit of a misnomer. A better term might be ‘content type’, since it refers to the various kinds of content you can create for your WordPress site. The two most common and frequently-used post types are Posts and Pages, although there are a few other default options.
While you can do a lot with the post types WordPress supplies, sometimes you’ll want additional flexibility. For example, let’s say you use your website to run an e-commerce store. In this case, you could benefit from having a Products post type. This would be set up with all the features and information you need to create individual product pages.
In fact, this is one of the things that popular e-commerce plugins such as WooCommerce do for you:
There are actually a lot of plugins that add new custom post types to your site. You can even create your own post types, both manually and using a plugin. Either way, this is a great method for expanding what you can do with WordPress, and streamlining the process of creating new content.
Why you might need to password-protect custom post types
Sometimes, you want any visitor to be able to view everything on your website. However, that’s not always the case. In certain situations, you may want to hide specific content and only display it to approved or logged-in users.
Here are just a few examples of scenarios when you might want to do this:
- E-commerce websites If you’re running a wholesale store or something similar, you may want to restrict some or all of your products from public view.
- Online portfolios You may not want just anyone to view your work – instead, you can keep it locked away from those you don’t trust.
- Image galleries For photographers selling their work online, it can be useful to set up private galleries and hide them from everyone except specific clients.
- Event-based sites Websites that feature events often want to restrict information, and display it only to people who have been invited to the event or who have paid for access.
In these situations, you can hide anything that needs to be kept private by password-protecting the relevant custom post types. If you have a custom Products, Portfolios, Galleries, or Events post type, for example, you can ensure that only those with a password you choose can view that content. Fortunately, doing this is easier than you might expect, as long as you have a WordPress custom post type plugin.
How to password-protect any custom post type in WordPress (2 methods)
If you do need to password-protect one or more post types in WordPress, all you need are the right tools and a little instruction. Below, we’ll present two ways to get the job done, using a WordPress custom post type plugin. Keep in mind that these techniques will work for all post types – including the default options.
1. Password-protect custom posts for all visitors
First up, let’s talk about how to hide specific content within a custom post type from anyone who visits your site – except those with the right password. To do this, you’ll need the Password Protected Categories plugin:
This WordPress custom post type plugin makes it easy to secure any type of content with passwords, and to customize what is made private and what is kept public.
Install the plugin and configure its settings
To get started, install Password Protected Categories on your website. Then navigate to Settings > Protected Categories:
Here you can paste in your license key, in order to access the plugin’s full functionality. You can also customize how long passwords will be active for, and what the login form for password-protected content will look like:
Save your changes here.
Password-protect specific custom post type categories
Next, go to the Categories screen for the relevant custom post type (for example, Events > Categories):
If you select a specific category here and scroll down to the bottom of the page, you’ll find a new Visibility section:
Here, you can choose whether to make the category public, or protect it with a password. In the latter case, simply enter whatever password you’d like and save your changes. You can also click on the plus icon to add multiple passwords to one category.
In practice, this means that if you add all content in a custom post type to a particular category, you can password protect the entire group. By adding all your events to an Events category, in other words, you can keep them private from everyone except approved visitors.
How to restrict only some of a custom post type's content
It’s also worth noting that you can protect only some of the content under a specific custom post type. For instance, let’s say you advertise both public and private events on your site. You want everyone to see the public events, but you want to restrict the private events to attendees only.
To do that, you can put all your events into one category, and then create two sub-categories: Private Events and Public Events. Then, simply password-protect the former, and leave the latter set to Public:
That's all you need to do!
Password-protecting the WooCommerce 'Products' post type
Finally, if you’re running a WooCommerce store, you’ll want to opt for the WooCommerce Password Protected Categories plugin instead:
This WordPress custom post type plugin has very similar functionality, and can be used via the same process described above. However, it integrates fully with WooCommerce, and supports its custom Products post type.
2. Restrict access only to specific user roles
The above process will work well in most cases. However, sometimes you’ll want to password-protect custom post types only for certain kinds of users. For instance, you might want to restrict access to an 'events' post type for random visitors, but display them freely to subscribers.
You can achieve this using a simple 2-step process:
- First, mark the custom post type categories that you want to hide as 'Private'.
- Next, control which user roles can see private custom post type categories and their posts.
I'll tell you how to do this next.
a. Create private custom post type categories
In this case, you'll still need to start by installing and setting up the Password Protected Categories plugin (or WooCommerce Password Protected Categories if you're protecting WooCommerce products).
Instead of password protecting the custom post type categories that you want to hide, you need to mark them as 'Private'. To do this, go to the Categories page for whatever custom post type you want to edit. Choose the parent category that includes all of your custom post type content, and mark it as Private under Visibility.
Save your changes. This will hide them from everyone except for logged in users whose role allows them to access private content.
b. Edit your user roles
Next, you need to specify which logged in user roles should be able to see your private custom post type categories and the posts within them. You need one additional tool for this – the free User Role Editor plugin:
With this plugin, you get a lot more control over the way user roles work on your WordPress site. You can create new roles, customize the existing ones, and much more. Plus, it’s completely free to use.
After installing the plugin, go to Users > User Role Editor in your dashboard:
Select the role you want to edit – for example, Subscriber. Then check the box labeled Show capabilities in human readable form. This makes the information here much easier to understand. Scroll down a bit after that, and look for the options Read private pages and Read private posts:
By checking these boxes, you’ll give subscribers the ability to see pages and posts that are marked private. In addition, you may see more options here – one for every custom post type on your site. For instance, if you see a box labeled Read private events and check it, subscribers will now also be able to view events that are marked as private (but those events will be hidden from everyone else).
Click Update here to save your changes, and you’re all set! Users with the roles you chose will be able to view all of your private custom post content, both in the parent category and any sub-categories. This protected content will remain private from other user roles and regular visitors alike.
Where to get the plugin
If you use custom post types on your website, you’ll want to think carefully about who can access their content. There are many situations when you’ll want to restrict certain people from viewing particular post types. Fortunately, this is easy to do if you have a WordPress custom post type plugin.
In this article, we’ve introduced two ways to password-protect any custom post type in WordPress:
- Password-protect content for all visitors using the Password Protected Categories plugin.
- Restrict access to specific people with the User Role Editor plugin.
Do you have any questions about how to use this WordPress custom post type plugin? Ask away in the comments section below!
Image credit: freeGraphicToday.