Build or Buy Private Catalog and Page Access Control on Shopify?
Private catalog and page access control is a BUY, because Shopify's password protection is store-wide only. Shopify's own documentation states that when activated, all of your online store's pages are hidden from visitors and search engines (verified Sep 2026). Locksmith carries the category alone at 4.7 stars across 286 reviews, priced to your Shopify plan from $12 to $199/month (verified Sep 2026).
Your profile — see how the verdict shifts
- Confidence
- High — Read Shopify's password page documentation and its customer accounts documentation on 2026-09-03, and worked through 24 listings in the Store management and Security category. Shopify's password protection is explicitly store-wide: activating it hides every page from visitors and search engines, and the feature offers a landing page, custom messaging, an email-signup banner and an optional B2B-only restriction, with no page-by-page control. The customer accounts documentation describes no way to restrict specific pages or catalogs to logged-in customers or segments. In the category itself, Locksmith is the only dedicated general-purpose gating app found, at 4.7 stars across 286 reviews with a Built for Shopify badge. A second candidate could not be found under any slug tried, and the nearest alternative gates by wholesale account rather than by link or passcode.
- Reference scenario
- $20M–$100M GMV · Online Store theme · trade previews, press pages and unlisted drops · no wholesale account workflow in place
- As of
- September 2026
Decision at a Glance
| Your profile | Verdict | Why |
|---|---|---|
| Occasional press or trade preview, Basic or Grow plan | BUY | At $12–$29/month by plan (verified Sep 2026) the app costs less than the meeting about it. The alternative is hiding your whole store from search engines to conceal one page. |
| Recurring unlisted drops and segment gating, Advanced plan | BUY | Conditions covering tags, passcodes, secret links, geography, purchase history and date or time already do everything a drop calendar needs. Building the same rule engine buys nothing new. |
| Shopify Plus, with gating as a permanent part of the model | CUSTOMIZE | The Plus tier runs $199/month (verified Sep 2026), and a permanent gating model deserves an entitlement rule you own. Keep the app on the storefront and put the source of truth in your own systems. |
| Headless or custom storefront | BUILD | A theme-level lock has nothing to attach to when the frontend is yours. Access control moves into your own middleware, where it also has to cover APIs and feeds rather than just pages. |
What Private catalog and page access control Actually Drives
| Outcome | Impact | How it works |
|---|---|---|
| Revenue — indirect | High | Store-wide password protection hides every page from search engines, so using it to conceal one collection costs the organic visibility of the entire catalog. |
| Customer experience | High | A press or trade visitor holding a link reaches the content directly, instead of meeting a registration and approval workflow designed for wholesale buyers. |
| Revenue — direct | Medium | A gated drop turns an invite list into orders on a page nobody else can reach, which is what keeps a limited release actually limited. |
| Operational efficiency | Medium | Gating by tag or passcode replaces the duplicate hidden storefronts and manual link juggling that teams build when no gating exists. |
| Data & insight | Low | Access logs by passcode or issued link show which invited audiences opened a preview and when, which no store-wide password can report. |
Spend ceiling: Size the spend against your Shopify plan, because the app's price keys to it: $12/month on Basic through $199/month on Plus (verified Sep 2026). A Plus merchant pays roughly $2,388 a year (illustrative) to gate a press page, which is the point where owning the rule starts to look reasonable.
What buying enables (top apps)
- + Locks applied to products, pages, collections or the entire store from one place
- + Access conditions covering customer tags, email addresses, passcodes, secret links, geographic location, purchase history and date or time
- + No account registration required, so a journalist or a buyer with a link gets straight in
- + A Built for Shopify badge and 286 reviews behind a category this narrow, which is unusual depth
What building additionally unlocks
- + Enforcement on a headless or custom frontend, where a theme-level lock has nothing to attach to
- + One entitlement source of truth read by the storefront, the APIs, product feeds and any future channel alike
- + Tokenized access links with expiry, revocation and logging, issued and audited by your own systems
- + Independence from a single-vendor dependency in a category that has exactly one dedicated app
Find Your Verdict in 3 Questions
Does the gated audience need to register and be approved before seeing anything?
Yes: Your verdict: BUY. A wholesale or B2B gating app fits that workflow better than generic page locking does.
No: Go to question 2.
Does your storefront run on a standard Shopify Online Store theme?
Yes: Go to question 3.
No: Your verdict: BUILD. A theme-level lock has nothing to attach to on a custom frontend, so enforcement moves into your own middleware.
Is gated access a permanent part of how you sell, rather than an occasional preview?
Yes: Your verdict: CUSTOMIZE. Keep the app on the storefront and build the entitlement source of truth you actually own.
No: Your verdict: BUY. Locksmith at $12–$199/month by plan (verified Sep 2026) beats store-wide password protection and a B2B buildout alike.
The TCC Scorecard — 12 Dimensions
TCC — Total Cost of Capability: what it actually costs to have this capability over three years, whichever way you get it. Each dimension is scored 0–5 for both paths. How we score →
| Dimension | Buy | Build | Why |
|---|---|---|---|
| Cost | |||
| Acquisition & implementation | Locksmith installs on a 15-day trial and gates a page the same afternoon, while an entitlement layer takes an estimated 4–8 weeks (Deploi estimate, illustrative). | ||
| Recurring fees | Pricing keys to your Shopify plan rather than usage, so the same feature costs $12/month on Basic and $199/month on Plus (verified Sep 2026). | ||
| Maintenance & upgrades | The vendor keeps locks working through theme and platform changes, which is genuine ongoing work on a surface Shopify keeps evolving. | ||
| Switching & exit | Locks are app configuration, so uninstalling exposes every gated page at once rather than leaving them hidden; owned rules simply keep working. | ||
| Risk | |||
| Vendor risk | One dedicated app carries this whole category, and 286 reviews with a Built for Shopify badge softens that without removing the single-vendor dependency. | ||
| Security & compliance surface | Gating is security-adjacent work, and a mature app has already handled the direct-URL and endpoint cases a first build usually misses. | ||
| Platform-deprecation exposure | A theme-level lock depends on the Online Store surface, so a headless move or a checkout change leaves it behind entirely. | ||
| Value | |||
| Fit to requirement | Gating by passcode, secret link or customer tag matches a press preview exactly, where a B2B account workflow would ask a journalist to register. | ||
| Time to market | A drop with a date on it needs a gate this week, and no build competes with an app that locks a collection in an afternoon. | ||
| Performance & scale | Both lanes evaluate a rule per request, and neither becomes a scale problem at mid-market traffic. | ||
| Data ownership & AI-readiness | Who may see what is a commercial rule, and owning it means the storefront, the API and every future channel read the same source of truth. | ||
| Focus & opportunity cost | Access control is infrastructure nobody's roadmap wants, and it is the definition of work to rent unless your architecture forces otherwise. | ||
The App Landscape
| App | Status | Pricing | Best for |
|---|---|---|---|
| Locksmith | Live — flagged — 4.7★, 286 reviews; Built for Shopify; tiers priced by your Shopify plan with no itemized feature limits on the listing, so confirm on the current listing | $12/month on Shopify Basic; $29/month on Grow; $99/month on Advanced; $199/month on Plus; 15-day trial (verified Sep 2026) | Everything from a one-off unlisted drop to segment-gated collections, without building a B2B account workflow |
| Shopify password page | Native — First-party Shopify feature, and store-wide only. Shopify's documentation states that when activated, all of your online store's pages are hidden from visitors and search engines. The feature offers a customizable landing page, custom messaging, an email-signup banner and an optional B2B-only access restriction, with no page-by-page gating anywhere. Shopify's customer accounts documentation describes no way to restrict specific pages or catalogs to logged-in customers or segments. | Included on every Shopify plan (verified Sep 2026) | Taking the whole store offline before a launch, which is the single job it does well |
| B2B and wholesale gating apps | Category — The adjacent category that looks like a substitute and is not. These apps gate a storefront behind wholesale customer accounts, so a visitor registers and waits for approval before seeing anything — right for a wholesale program, wrong for a press page or an unlisted drop where the visitor holds a link and a deadline rather than an account. Sami B2B Lock is the largest of them at 943 reviews. | Low monthly tiers varying by listing; confirm on the current listing (illustrative) | Wholesale programs where registration and approval is the intended experience rather than friction |
| Entitlement layer in your own storefront (custom) | Build lane — The lane that opens once the storefront is headless or gating becomes permanent: one source of truth for who may see what, enforced below the template so direct URLs, JSON endpoints, feeds and sitemaps obey the same rule, plus issued links with expiry and revocation. More work than an app and the only option when a theme-level lock has nowhere to run. | $14,000–$40,000 one-time plus upkeep (Deploi estimate, illustrative) | Headless storefronts, and businesses where gated access is a permanent commercial model rather than an occasional preview |
The Build Path
- One source of truth for who may see what: Model the rule once: audience defined by customer tag, segment or issued token, resource defined by product, collection or page, plus a validity window. Scattering conditionals through theme templates is how gating quietly develops holes, because the next developer adds a template that nobody remembers to gate. One rule table, consulted everywhere, is the whole design.
- Enforce below the template, not above it: Hiding a link is not gating. A real implementation covers the direct product URL, the JSON endpoints a theme calls, the sitemap, search indexing, product feeds and any app reading your catalog through the API. Test by hitting the resource directly with no session, which is exactly what a forwarded link does. This is the step first builds miss and mature apps already handle.
- Issued links with expiry and revocation: Press previews get forwarded, so treat access as a credential rather than a secret. Issue tokenized links with an expiry, log every use, and keep revocation a single action. Logging also answers the question the marketing team asks after every preview: which invited audiences actually opened it, and when.
- Effort band
- $14,000–$40,000 for the entitlement model, enforcement below the template and tokenized access links — Deploi estimate (illustrative); lands in the $10–25K contact-form band for a single storefront, $25–75K when headless plus APIs and feeds are in scope
- Typical timeline
- 4–8 weeks, with the enforcement testing taking longer than the rule engine (Deploi estimate, illustrative)
- Maintenance, honestly
- ~15% of build cost per year (Deploi estimate): roughly $2,100–$6,000/yr (Deploi estimate, illustrative), mostly re-testing enforcement after theme and API changes and gating each new surface as it appears.
- What you own — and what you take on
- You own: the entitlement rules, tokenized links with expiry and revocation, access logs, and one gate that covers pages, APIs and feeds alike. You take on: proving the gate holds on every new surface, which is ongoing work rather than a one-time test.
3-Year Total Cost of Capability
| Buy (app path) | Build (custom path) | |
|---|---|---|
| Year 0 (setup) | $0 (15-day trial, then subscription) | $14,000–$40,000 |
| Years 1–3 (recurring) | $432–$7,164 (subscription, by Shopify plan) | $6,300–$18,000 (upkeep) |
| 3-year total | ≈$432–$7,164 | ≈$20,300–$58,000 |
- † All figures illustrative samples for the reference scenario — not quotes, not verified pricing.
- † Buy column assumes the Advanced-plan tier, since pricing keys to your Shopify plan rather than to feature usage.
- † Build column covers the entitlement model, enforcement below the template and tokenized links, plus annual upkeep; three-year horizon.
What the Sticker Price Hides
On the buy path
- — Pricing keys to your Shopify plan rather than to usage, so upgrading to Plus takes the same feature from $12 to $199/month (verified Sep 2026)
- — Locks are app configuration, so an uninstall or a billing lapse exposes gated content instead of hiding it
- — One dedicated app carries this category, which is a genuine single-vendor dependency however mature that app is
- — A theme-level lock lives on the Online Store, so a headless move or a custom frontend leaves it behind entirely
On the build path
- — Gating is security-adjacent, so direct URLs, JSON endpoints, sitemaps, feeds and search indexing all need covering rather than just the page template
- — Tokenized links get forwarded, which makes expiry and revocation requirements rather than refinements
- — Every new surface — an app, a feed, a new channel — has to consult the same rule or the gate develops a hole nobody notices
- — ~$2,100–$6,000/yr in upkeep (Deploi estimate, illustrative)
What Merchants Say
The recurring discovery: switching on the password page to hide one preview takes the entire store out of search results at the same moment.
A common frustration with account-based gating: press and trade visitors get asked to register and wait for approval when all they had was a link and a deadline.
If You Change Your Mind Later
If you bought and outgrow it
Uninstalling exposes every gated page at once, so sequence the removal before the subscription ends rather than after. Keep a written record of each lock and its condition outside the app, because the configuration is the only place that knowledge lives.
If you built and want out
Nothing strands. Entitlement rules, issued tokens and access logs live in your own systems and keep working through a theme change, a replatform or a move to headless, which is exactly the scenario that strands an app-based lock.
When This Answer Changes
We're watching for:
- ▸ Shopify adding page-level or segment-level gating to the Online Store or to customer accounts
- ▸ A second dedicated general-purpose gating app reaching a real review base, since one app carries the category today
- ▸ A move to headless, which removes the surface a theme-level lock depends on
Verdict change log:
No changes since first publication (September 2026).
Common Questions
Can you password protect a single Shopify page?
Not natively. Shopify's password protection is store-wide: its documentation states that when activated, all of your online store's pages are hidden from visitors and search engines (verified Sep 2026). No native setting gates one page, one collection or one customer segment. Locksmith is the dedicated app that does, at 4.7 stars across 286 reviews (verified Sep 2026).
What does Locksmith cost?
Locksmith prices against your own Shopify plan rather than by feature tier: $12/month on Basic, $29/month on Grow, $99/month on Advanced and $199/month on Plus, after a 15-day trial (verified Sep 2026). Every plan gets the same conditions, including customer tags, passcodes, secret links, geographic location, purchase history and date or time.
Can Shopify customer accounts restrict pages to certain customers?
No. Shopify's customer accounts documentation does not document restricting specific pages or catalogs to logged-in customers or to customer segments (verified Sep 2026). The capability sits in B2B company-account territory, which requires registration and approval. A press page or unlisted drop needs generic gating instead, from an app or a custom entitlement layer at $14,000 to $40,000 (Deploi estimate, illustrative).
Your Next Steps
If you're going with BUY(matches your selected profile)
- List every audience you gate for — press, trade, invited customers, staff — and the condition each one should match
- Run the 15-day trial and test each lock by hitting the product URL directly with no session, the way a forwarded link behaves
- Check what your Shopify plan tier means for the price, since the same feature costs $12/month on Basic and $199/month on Plus (verified Sep 2026)
- Document every lock and its condition outside the app, because uninstalling exposes all of them at once
- Confirm gated products stay out of your product feeds and sitemap, not just off the navigation
If you're going with CUSTOMIZE
- Define the entitlement rule once — audience, resource, validity window — before writing any enforcement code
- Enforce below the template so direct URLs, JSON endpoints, feeds and sitemaps all obey the same rule
- Issue tokenized links with an expiry and a revoke action, and log every use for the post-preview questions
- Keep the app in place while the build is proven, then remove locks deliberately rather than by uninstalling
Official Docs & Sources
- Password page — Shopify Help Center
- Customer accounts — Shopify Help Center
- Customer account UI extensions — shopify.dev
Official documentation linked for verification — our verdicts and estimates are our own.
Related Decisions
Build or Buy VIP and High-Value Customer Support Routing on Shopify?
No helpdesk sells VIP routing as a feature. Tag high-value and wholesale customers with a free Shopify Flow workflow, then route on that tag in your helpdesk.
Should You Build or Buy an AI Support Agent on Shopify?
An AI support agent is the rare capability where WAIT deserves a seat at the table: buy for speed, build for verified answers.
Should You Build or Buy a Helpdesk on Shopify?
Buying a helpdesk wins for mid-market Shopify stores; build only the integration glue.
Should You Build or Buy an FAQ Help Center on Shopify?
An FAQ help center favors building: server-rendered answers on your own domain compound as search and AI citations, while hosted KBs trap the content.
Should You Build or Buy a Returns Portal on Shopify?
A returns portal splits by return economics: WAIT on native for simple flows, BUY exchange-first in the mid-market, BUILD at 3PL scale.
Ready to gate one page without hiding the whole store?
For most stores the answer is an app and an afternoon, and we will say so. The build conversation starts when your storefront is headless, when gated access is a permanent part of how you sell, or when the same rule has to cover pages, APIs and product feeds at once.
Contact us todayVerdict scored for the reference scenario above. Estimates are not quotes; app pricing carries its verification date and gets re-verified quarterly. Full scoring anchors: see the TCC methodology.
Read how we score these decisions (the TCC Framework). No affiliate links, no paid placement — no app vendor pays to appear here.