Password protect a page or collection
Shopify's built-in password protects the whole store, which is rarely what you want.
Prime Lock puts a passcode on one page, one collection, or every URL matching a pattern, and leaves the rest of the storefront selling.
The problem
Shopify's store password lives in Online Store → Preferences and does exactly one thing: it puts a splash screen in front of everything. Google cannot crawl you, your ads land on a password form, and your existing customers cannot buy. For a store in development that is correct behavior. For a store that needs one confidential page, it is a sledgehammer.
So merchants build their own. A page template gets a small form, a hardcoded string, and a `localStorage` flag. The check runs in the browser, which means the passcode is in the page source, the protected content is in the page source underneath the overlay, and clearing a flag in devtools reveals it. It also means the page is fully readable by anything that does not run JavaScript, including Google's crawler on a bad day and every scraper on a good one.
The other route is an unlisted page: publish it, do not link it, add `noindex`, and hope. That is security by nobody-guessing, and it collapses the moment one recipient forwards the URL.
How Prime Lock does it
A passcode gate in Prime Lock is a server-side rule with a real token behind it.
- 1
Lock type → Passcode gate
The visitor gets a passcode prompt instead of the content. Nothing behind the gate is sent to the browser until the code checks out.
- 2
Applies to → Pages, or a URL pattern
Point it at a single page, or use a pattern like `/pages/press-*` or `/collections/sample-sale` so future pages that match are covered without a new rule.
- 3
Who can unlock → Passcode
One code per lock on Free. On Pro you can issue several codes for the same lock so you can see which audience is actually using theirs.
- 4
Also allow a secret link → On: ?key=… with expiry and usage caps (Pro)
For people you do not want to make type anything: press, a buyer, a partner. Set an expiry date and a maximum number of uses; the link dies on its own.
- 5
Schedule → Optional date window
Handy for an embargo: the page unlocks itself at the moment the news goes out.
- 6
Storefront behavior → Show custom message
Explain what is behind the gate and how to get a code. A bare password box with no context is where visitors leave.
What the customer sees
Same enforcement path as every other lock type: the passcode grants a token, and the token is what checkout verifies.
Sample Sale, Runner · EU 42
Aspedan Supply · SKU BCT-24
Enter your access code
The product page is still indexable by Google, only the price is withheld.
Why enforcement matters here
A passcode typed into a theme-level form is a client-side check: the code and the content both already arrived in the browser, and the form only decides whether to reveal what is already there. Anyone can read the page source, and anyone with the URL can skip the form by disabling JavaScript.
In Prime Lock the correct passcode grants a signed access token scoped to that lock. Storefront rendering checks the token before content is sent, and the checkout Function verifies it again before an order can be completed. Sharing the URL without the code gets nowhere; sharing a cart permalink for a gated product gets a blocked checkout rather than a completed order.
Related
Blog
Store password vs. a lock app
When Shopify's free password is the right answer, and when it costs you traffic.
ReadBlog
Locked pages and SEO
How to gate content without deindexing the page that earns your traffic.
ReadDocs
Create your first lock
Passcodes, secret links, expiry and usage caps, step by step.
ReadDecide who gets to see your store.
Early access opens with the free plan. Unlimited locks, enforced at checkout.
No newsletter. One email when Prime Lock is live.