How to Password Protect a Page on Shopify

What Does Shopify Give You Without an App?

Shopify's built-in password locks the whole online store, not one page. Shopify calls it private mode, and the Help Center describes what it does in one sentence:

You change the access mode from the access setting menu on the Online Store page of your admin, and you manage the password under Online Store > Preferences. When you first register for a Shopify plan, the store starts in private mode by default. If you searched for “password protection”, it is the same setting: the mobile steps in the same Help Center article call it that.

In Shopify adminOpen in your store

1. Online Store
2. Preferences

Zoom

Shopify's example of an extra private-mode setting is restricting access to B2B customers only, which it describes for a dedicated B2B store. That is a store setting: it decides who sees every page, not who sees one of them. Shopify B2B isn't available on the Starter or Retail plans.

If you want the whole store closed until launch rather than one page locked, our guide to setting up a coming soon page covers private mode and the password page.

A single page has just two visibility states. In the page editor, Shopify's page settings let you choose Visible or Hidden, and Hidden hides the page from your online store. There is no audience in that choice, so Hidden cannot let approved customers in while keeping everyone else out.

In Shopify adminOpen in your store

1. Online Store
2. Pages

Zoom

For specific pages, the Help Center's B2B documentation says you can restrict access “using custom development or third-party apps”, which are the two routes below. The App Store's built-in features page for customer accounts lists Lock pages as supported but gives no steps, so we follow the Help Center here.

Which Route Fits the Page You Want to Lock?

For one page, the choice is between a template lock in your theme and an app.

If this page is the first step of a paid membership, with tiers, member pricing or recurring billing, the decision is wider than one page. Our members-only store guide compares the storefront password, customer accounts and per-customer gating side by side.

We carry one example through the guide: a wholesale price list on a page called Wholesale prices, meant only for customers tagged wholesale.

How to Lock One Page With a Template and Customer Tags

The idea is simple. The page gets its own template, the template gets one extra section, and that section decides what to print by looking at the visitor. Everything below runs in the Shopify admin and the theme editor; nothing needs an app.

Why should the check read a tag, not just a sign-in?

With sign-in links turned on, customer accounts let customers sign in with passwordless authentication: there is no password to share or leak. The catch is what happens when someone you have never heard of signs in:

So “is a customer signed in?” is the wrong question for a wholesale price list. The right question is whether this customer carries the tag you gave them.

Treat that tag as a filter, not a secret. Shopify notes that themes and apps can add tags to customers, and Dawn's footer signup form sends one in a hidden field. We could not establish whether a tag changed in that field reaches a customer profile: see our test.

So choose a tag name that is hard to guess and that your theme and apps don't add, and don't rely on this lock for anything confidential.

If your store still runs legacy customer accounts, Shopify has deprecated them and said a final sunset date would be announced later in 2026. We found no announced date on that changelog post or Shopify's upgrade page when we last checked them. After an upgrade, Shopify redirects legacy URLs such as /account/login to the new accounts. Our guide to moving off legacy customer accounts covers the rest of that switch.

Tag the customers who should get in

Open the customer in Customers and, in the Tags section, add your tag. For a batch, select the customers in the list and click Add tags. In the example, every approved wholesale buyer gets wholesale.

In Shopify adminOpen in your store

1. Customers

Zoom

Shopify says tags are not case sensitive in the admin. Your check is a separate thing: it compares the text you type in the code with the customer's tags, so write the tag in the code exactly as the admin shows it. We tested letter case: see our test.

The check further down carries its own Sign in link, but the Help Center says customers can't sign in after you hide sign-in links, while its B2B documentation calls showing them optional. Keep sign-in links turned on, as where to turn on customer login shows, or test a real sign-in if you keep them off.

Create a page template and assign it

If the page doesn't exist yet, create it first with Add page in Online Store > Pages. Then, in the theme editor of your live theme, click the Home page drop-down menu at the top of the editor (it names whichever template is open, Default page in our screenshot), choose Pages and click Create template. Name it after the page, wholesale in the example, and base it on Default page.

In Shopify adminOpen in your store

1. Online Store
2. Edit theme

Zoom

Assign the template just before you test, once the check, the protected text and seo.hidden, all covered below, are in place: open the page in Online Store > Pages and pick the new template in the Template drop-down, which Shopify's Help Center calls Theme template. That list shows only the templates in your current live theme, so a template created in a draft copy won't appear there.

In Shopify adminOpen in your store

1. Online Store
2. Pages

Zoom

Two setups can't create the template. The Starter plan doesn't support creating new templates, and Shopify's theme comparison lists creating templates from the theme editor for Online Store 2.0 themes and themes with theme blocks, including the Horizon family, not vintage ones. Our FAQ on creating and assigning a custom page template covers the cases where the template doesn't show up.

Add the tag check in a Custom Liquid section

Open the new template in the theme editor, click Add section in the Template group and choose Custom Liquid. Shopify's Help lists custom Liquid among the sections a template area can hold; if Liquid is new to you, the check below is all you need to paste.

If your theme has no Custom Liquid section in the Template group, the check below goes into a section file through Edit code, and Shopify lets you edit theme code only after you've purchased the theme.

The check uses three documented pieces.

• The customer object is nil when the visitor isn't signed in, and its tags field is a list of the customer's tags.
• The contains operator checks for a string within that list.
• And routes.account_login_url is the sign-in URL, which redirects to customer accounts when they are enabled.

{% if customer and customer.tags contains 'wholesale' %}
  <div class="page-width">
    <h2>Wholesale price list</h2>
    <p>Orders of 10+ units: 30% off the retail price.</p>
  </div>
{% else %}
  <div class="page-width">
    <p>This price list is for approved wholesale customers. <a href="{{ routes.account_login_url }}">Sign in</a> with your wholesale account to see it.</p>
  </div>
{% endif %}

The price list inside the first branch is sample text; replace it with your protected content and change wholesale to your tag. Keep the page's own body to a short teaser, because the check guards only what sits inside this section.

We ran this exact code: see our test for what we could and could not check. Test the tagged branch yourself with a customer whose inbox you can open.

In Shopify adminOpen in your store

1. Online Store
2. Edit theme

Zoom

What a Template Lock Does Not Cover

A template lock is honest about one thing only: what its own section prints. Keep three things in mind.

• Other templates. Shopify documents a view URL parameter that renders a page with an alternate template. Your check lives in one template, and the page can be requested with another, where the page's content is not behind your check.
• Theme updates. Shopify says changes made in the theme editor, including sections and new templates, are copied to the updated theme, but its code-editing page warns that if you edited theme files and the changes are incompatible, “all your code changes are removed in the updated copy.” Keep a duplicate of the theme, and open the page signed out after every update or theme switch.
• Shopify's own preference. The Help Center advises editing theme files only if you can't make the change with a Shopify app or the theme editor, so use the Custom Liquid section rather than Edit code when your theme offers it. If nobody on your team will maintain the check, choose an app.

The practical rule: keep the protected text out of the page body. Put it inside the first branch of the Custom Liquid check, and let the body say only what the page is for. We tested what the page body shows: see our test.

How Do You Keep a Locked Page Out of Google?

Locking a page and keeping it out of search are two separate settings. Shopify generates a default robots.txt, but Google is plain about what such a file can and can't do:

Shopify gives you a per-page switch. Add a custom metafield of seo.hidden to the page and set its value to 1; Shopify says that hides the page from sitemaps, search engines and your online store search. Create the definition under Settings > Metafields and metaobjects > Pages, with the Integer type, then set the value on the page.

If the admin says the namespace and key are already taken, an app is already using seo.hidden and you can't change it in the admin. We tested the noindex side of seo.hidden: see our test.

In Shopify adminOpen in your store

1. Online Store
2. Pages

Zoom

The other route Shopify documents is a noindex tag in the <head> of your theme's theme.liquid file, matched by the page handle. Replace the placeholder with your page's handle, wholesale-prices in the example:

{% if handle contains 'page-handle-you-want-to-exclude' %}
<meta name="robots" content="noindex">
{% endif %}

A whole store in private mode is a different case, with its own answer: see what private mode hides from Google.

Our own test· November 6, 2026

What Our Test Showed

Key takeaway

We ran this exact check in a development store on Dawn, using the customer accounts sign-in; we did not test legacy customer accounts.

What we did, what came back and what it means for you

What we did	What came back	What it means for you
Opened the locked page signed out	The title, the page body and the fallback with its Sign in link; no protected block	A template based on Default page keeps the Page section, so the body isn't protected
Added ?view=contact or a made-up suffix to the URL	The Custom Liquid section disappeared; the page body still showed	Keep the protected text in the section, never in the body
Clicked Sign in in the fallback	It opened the customer accounts sign-in page, with Show sign-in links turned off; we could not finish a sign-in	Test a real sign-in if Show sign-in links is off: the Help Center says customers can't sign in after you hide those links
Ran contains on a test list we built in Liquid, Wholesale against wholesale; typed Wholesale on a customer tagged wholesale in the admin	No match in Liquid; the admin offered the existing tag	Write the tag in the code in the admin's letter case
Set seo.hidden to 1 on the page, as an Integer metafield	The page's HTML carried a robots meta tag reading noindex,nofollow, absent before; the page wasn't in the sitemap, but the sitemap's ID range ended before this new page, so it may not have been refreshed yet	Check your own sitemap once it updates
Previewed the template in the theme editor	The customer object was nil, so the fallback showed	In our run the preview couldn't reach the tagged branch, so test it on the storefront
Changed the hidden tag field in Dawn's footer signup form and clicked submit	hCaptcha held the submission from our automated browser, so no customer was created	We can't say whether a changed tag reaches a customer profile; use a tag that is hard to guess

Storefront page titled Wholesale prices

Zoom

We could not sign in as a customer, tagged or untagged, because sign-in sends a one-time code to an inbox our test customers don't have, and we could not check whether sign-in returns the customer to the page. Horizon's theme code also has a Custom Liquid section and prints the page body in its Page section, but we did not run the test there.

Checklist: Lock One Page Step by Step

The order matters in three places. Create the template in the theme that is live, or the page won't list it. Move the protected text into the section before you assign the template, so the locked page never shows it in its body. And set seo.hidden before you assign the template, so the seo.hidden setting is in place before the lock goes on.

When Is an App the Better Lock?

The template route checks one thing: a signed-in customer with a tag. An app earns its place when you need a shared password, a secret link, rules across many pages and products, or simply no code to look after.

The cards below are the five listings we read. They are a snapshot of what we found, not the whole App Store.

Page Lock Not Working?

Most failures come from the page never reaching your section, or from content sitting outside it. Match what you see to a row:

A page with no custom template assigned returns nil for its template suffix in Liquid, which is a quick way for a developer to confirm the first row.

The Bottom Line

The template route asks for one tag, one template and a few lines of Liquid, and it costs no app fee. What it asks in return is care: content outside the section isn't protected, and theme changes deserve a retest.

Frequently Asked Questions