WordPress already has the ability to hide selected content of any Post and Page with password protection. The “Visibility” settings are located just underneath the ‘Save Draft’ and ‘Preview’ button normally located to the right of the screen.

If you adjust these to ‘Password Protected’ and choose a password, WordPress will prepend the title with “Protected: ” and replace the content area (& comments) with a message requesting the password.

But what happens when custom fields are responsible for bringing in some of your content? By default, the content from custom fields is not protected, unless you take further steps.

The post_password_required function from the WordPress codex is how make sure the content within your custom fields only appears once the correct password is entered on your page or post.

Wrap your blocks of ACF content

if ( ! post_password_required() ) {
   // Your ACF code goes here.
}

When your custom field modules or Advanced Custom Fields content is wrapped within this type of conditional, you will ensure that those fields will be masked underneath the same password protection as default WordPress content.

Additional Reading:

• WordPress Codex: Using Password Protection
• WordPressCodex: Post Password Required