By default, password-protected posts and pages in WordPress are not intended to be indexed by search engines. Our plugin respects that intent and automatically excludes password-protected content from the generated sitemap, unless a setting or custom configuration overrides this behavior.Here’s how we handle this:
- Password-protected pages do not appear in the sitemap we generate, so they are not explicitly offered to search engines for crawling.
- We also add an X-Robots-Tag: noindex, follow header to the sitemap file itself, which tells crawlers not to index it directly.
- However, if external links point to the protected URL or other plugins or themes that expose it (e.g., in menus, RSS feeds, etc.), Google may still become aware of the URL, although it won’t index the actual content.
What you can do:
To ensure Google doesn’t index the password-protected page:
- Verify the page is not in the sitemap (you can check the raw XML at yoursite.com/sitemap.xml).
- Use the URL Inspection Tool in Search Console to see how Google sees the page.
- You may optionally add an X-Robots-Tag: noindex response header for just that page using server rules or a plugin like Yoast SEO, which allows fine-grained control.
- If the page was indexed previously, request removal via the Google Removals Tool.
