Shopify ships password protection for free. Online Store → Preferences → Restrict store access, set a password, save. The entire storefront goes behind a single page. Nothing renders, no product JSON is served, no theme code runs, nothing is indexable. It is the most secure lock available on the platform, because it sits in front of everything.
If your store is not launched yet, use it. That is the whole recommendation. Apps that sell "password protect your store" as a feature are selling you something Shopify already gives you.
What you also get for free
- A password page you can style, with an email capture field that feeds your customer list.
- A shareable bypass link (Preferences shows it) that lets a specific person in without typing the password.
- Complete crawler exclusion: no risk of a half-finished store being indexed.
- Instant on and off, with no app install, no theme change and no data to migrate.
Where it stops being the right tool
1. Part of the store must stay live
The most common case: retail trades publicly while the trade catalog is restricted. Or the homepage and about page are live while a collection is not. The store password cannot express this: there is one door and it is either open or shut.
2. Access differs by segment
One shared password means one level of access. If approved wholesale accounts should see trade pricing while the public sees retail, or if VIP customers get a drop 24 hours early, you need a rule attached to the customer rather than a secret attached to the store.
3. The opening is scheduled
A drop at Friday 09:00 means someone has to be awake to remove the password, and the store is completely dark until they are. Scheduled locks open on their own, and let the product page stay visible with the buy button disabled beforehand, which is worth real money, because that page can collect the interest.
4. You need per-recipient links
One shared password cannot be revoked for one person. Give it to twelve buyers and a journalist, and when it inevitably ends up in a forum, your only option is to change it for everyone. Per-recipient access links can be issued, expired and revoked individually, and you can see which ones were used.
Side by side
| Store password | Page-level locking | |
|---|---|---|
| Cost | Free | App, from free tiers upward |
| Scope | Entire storefront | Per collection, product, page or URL |
| Audience control | One shared secret | Tags, accounts, per-recipient links, passwords |
| Indexable while active | No | Yes, if you lock the price and not the page |
| Scheduling | Manual on and off | Scheduled open and close |
| Revoke one person | No | Yes |
| Right for | Pre-launch, rebuilds, seasonal closure | Mixed public and restricted trading |
Decision tree
Is any part of the store meant to be public right now?
|- No -> Shopify's store password. Stop here.
|- Yes
|
Does everyone restricted share the same access?
|- Yes, one shared secret is fine
| -> Page-level password lock on the restricted resources
|- No, access depends on who they are
|
Are you on Plus with real company accounts?
|- Yes -> Native B2B catalogs
|- No -> Tag-based locks with checkout enforcementMost merchants who arrive looking for a locking app actually need the top branch for the first month and the bottom branch from launch onwards. Use the free tool while it fits, and switch when the requirement outgrows it, not before.