Can Google index password-protected or private WordPress posts?

What a crawler sees on a protected post

Setting a post's visibility to Password protected changes what is displayed, not whether the address exists. A visitor or crawler without the password gets:

• an HTTP 200 response at the normal permalink;
• the title, with Protected: in front of it;
• a short password form where the content would be;
• no comments and no content in the feed;
• in archives, the line "There is no excerpt because this is a protected post." in place of an excerpt. Core's own site search leaves protected posts out for logged-out visitors.

WordPress does not add a noindex tag to these pages, and its core sitemap lists them, because the sitemap includes every published post and a protected post is still published.

The result in search can be an entry reading "Protected: Client pricing 2026" with a snippet taken from the form or the surrounding template. The content is safe. The title, the slug and the fact that the page exists are not.

Private posts are a different thing

Private visibility is stricter. A private post is only served to logged-in users whose role allows it, by default editors and administrators. For everyone else, including every crawler, the address returns 404, exactly as if the post did not exist. It is left out of archives, feeds and the sitemap, because all of those list published posts only and private is its own status.

If a post was public and indexed before you made it private, it will drop out of Google as the 404 is recrawled.

Keeping protected pages out of search

If the title or existence of a protected page should not be public, the password is not enough. Add one of these:

1. Noindex the page. This is the right tool: the page stays reachable for people with the link and password, and search engines are told not to list it. In Hydrogen SEO, switch on No Index in the post's SEO settings sheet. Do not also block it in robots.txt, or the noindex will never be read.
2. Give it a neutral title and slug. "Protected: Documents" at /documents-7f3k/ reveals less than a client's name.
3. Use Private instead, if the readers all have accounts on the site.
4. Keep it out of the sitemap. Hydrogen SEO's sitemap always leaves password-protected posts out, and omits anything set to noindex.

For material that must not leak at all, a WordPress post password is the wrong protection. It is a single shared secret stored with the post, with no accounts or audit trail. Use a membership system or keep the files off the public site.

Common mistakes

Protecting a page to "hide it from Google". It hides the content, not the page. Use noindex for that purpose, and a password only when readers need a gate.

Password-protecting indexed content. If a page ranks and you protect it, Google's next crawl finds a title and a form. The page will lose its rankings for the hidden text, and may linger as a thin result. If the change is permanent, noindex it too.

Assuming files are protected. The password covers the post. Images and PDFs attached to it sit in the uploads folder at their own public URLs, reachable by anyone who has the link and indexable if linked from elsewhere.

Password-protecting a staging site page by page. Use HTTP authentication at the server for the whole site instead, which returns 401 to crawlers before WordPress loads.

To see what Google has, search site:example.com "Protected:", then check any result with URL Inspection.