WooCommerce Hide Products | Products, Categories Visibility by User Roles

WooCommerce Hide Products decides what each visitor is allowed to see in your catalog. Build a rule from four plain parts: who it applies to, what it covers, what it does, and optionally when it runs. Everything else exists to make sure that rule is actually enforced, everywhere, and that search engines are told something coherent about the result.

Version 10.0 is a complete rewrite. New rule engine, new admin experience, hardened query layer, and full REST and Store API coverage. Your existing settings are imported automatically and the originals are left untouched.

What a rule can do

• Hide from the catalog – removed from listings, search, menus, feeds and the API
• Show only these items – build a restricted catalog from a whitelist
• Hide the price – product stays visible and indexable, price is replaced
• Block purchasing – catalog mode for a role, a region or an approval flow
• Require a signed in account – members only products

Who a rule can target

• User roles, including custom roles from any membership or role plugin
• Guests – visitors who are not signed in are a first class audience
• Individual users by name or email
• Anyone holding a capability
• Everyone, or any signed in user
• Exceptions that always win – exempt named users or roles from any rule
• Multiple user roles resolved by a priority order you control

What a rule can cover

Products, categories and tags are added together. Then these narrow the selection rather than widening it, so everything in Wholesale over 100 that is still in stock is one rule, not four:

• Product type – simple, variable, grouped, external, plus any type an extension registers
• Stock status – in stock, out of stock, on backorder
• Price range – compared against the active price, so a sale price is what counts
• SKU pattern – wildcards, for example WHOLESALE-*
• Product attributes
• Child categories of the parents you chose, at any depth
• Never include these products – one exception inside an otherwise correct rule

Where the rules are enforced

Removing a product from the shop page is presentation. Enforcement means every way of reaching that product agrees:

• Shop, category, tag and search pages
• Site search and product suggestions
• Navigation menus, pruning descendants along with their parent
• Related products, upsells, cross sells and grouped children
• Product shortcodes and WooCommerce blocks
• RSS and Atom feeds
• The WordPress REST API, the WooCommerce REST API and the Store API
• oEmbed and preview endpoints
• The cart, revalidated on every load and again at checkout
• XML sitemaps and structured data

Why the API layer matters more than it sounds. A modern WooCommerce store answers on /wp-json/wc/store/v1/products, which is public by design and returns catalog data with no template code running. A plugin that filters only the main query hides a product from the shop page while leaving it fully readable at that URL, to anyone, with no authentication. That single gap voids every rule. This plugin closes it by default, and the built in status report warns you if it is ever switched off.

Built for SEO, not against it

Restricting a catalog and ranking well are not in conflict, but they interact in ways that are easy to get wrong. The position this plugin takes is that a gated page should be honest and excluded, not clever and indexed.

• Crawlers see the guest view by default, so what is indexed and what is public stay in agreement
• noindex, follow on restricted pages – keeps thin gate pages out of the index while link equity still flows through to the pages that are public
• Dropped from XML sitemaps – WordPress core plus Yoast SEO, Rank Math, All in One SEO and SEOPress. Sitemaps are always built against the guest policy, never against whoever requested the file
• Structured data is corrected – when a price is hidden the Offer is removed, because marking up a price the visitor cannot see is a structured data policy violation, not merely untidy
• Breadcrumbs pruned – no dead internal links and no false BreadcrumbList claims
• Real 404 instead of a soft 404 – a page that says “not available” while returning HTTP 200 wastes crawl budget
• Configurable canonicals, defaulting to leaving them alone

Choosing the right tool matters: hide removes the page from the index, while hide price and block purchasing keep the page indexable and keep its inbound links working. For most wholesale stores the second is what you actually want.

Security

• Every database statement is prepared. Identifier lists are bound through $wpdb->prepare() with placeholders generated from a count, never concatenated
• Nonce, then capability, then rate limit on every state changing request
• Verified crawler detection using forward confirmed reverse DNS, the method every major search engine documents. A User-Agent header alone proves nothing and is never trusted by default
• Forwarding headers ignored unless the site declares it sits behind a trusted proxy
• Audit log of every rule change, storing a salted hash of the client address rather than the address itself
• No unauthenticated AJAX handler and no public REST route anywhere in the plugin
• Uploaded import files are confirmed as genuine uploads, size capped, depth limited on decode and validated field by field

Built in tooling

• Live match count in the rule editor, so you can see how many products a rule covers before you save it
• Per product panel showing exactly what every role can do with that product: full access, hidden, no price, cannot buy or must sign in
• Per product overrides for the one item that needs an exception
• Status report naming the page caching layer it detected and what that means for rule enforcement
• Import and export of rules and settings as JSON, for moving a configuration between staging and production
• Audit log of who changed which rule and when
• Scheduling – run a rule between two dates and it takes effect and expires on its own

For developers

• More than twenty documented filters and fourteen actions
• A full authenticated REST API under cwgpv/v1
• WP-CLI commands, including wp cwgpv preview --user=42 to check exactly what one account can see, and wp cwgpv doctor for a configuration audit. Both are safe to run in CI
• PSR-4 style autoloading, one policy object per request, and a translation ready codebase with a bundled POT file

Compatibility

• WPML and Polylang – select only the parent product or category and every translation is covered automatically
• All WooCommerce product types, with variations covered when the parent is restricted
• High Performance Order Storage and the block based cart and checkout, both declared compatible
• YITH Ajax Product Filter and Ajax Search
• WooCommerce product blocks in the block editor
• Page cache coordination with WP Rocket, W3 Total Cache, WP Super Cache, LiteSpeed, WP Engine and SiteGround Optimizer
• Any standard theme that supports WooCommerce

Requirements

• WordPress 6.0 or newer
• WooCommerce 6.0 or newer
• PHP 7.4 or newer, 8.1 or newer recommended
• A persistent object cache such as Redis or Memcached is recommended but not required

Need of assistance?

Complete documentation ships inside the download. Open the documentation folder and load index.html in your browser, or read it without leaving your dashboard at Visibility → Documentation. It covers setup, how overlapping rules resolve, every setting explained, search engine behaviour, page caching, the developer reference and troubleshooting.

If you need help to configure, customize or make something compatible, we are here to help. Feel free to contact us.

Updates

 Version 10.0.0 on 20th August 2026 A complete rewrite. New architecture, new data model, new admin experience. Existing settings are imported automatically and the originals are left in place. Security Fix: SQL injection in the catalog query filter. Identifiers were concatenated into the WHERE clause over values that had never been cast to integers. All statements are now prepared. Fix: SQL injection in the taxonomy clause filter, which had the same defect. Fix: Complete access control bypass. Search engine detection matched the User-Agent header and granted matching requests an unrestricted view of the catalog. That header is chosen by the client, so any visitor sending "Googlebot" could read every hidden product. Crawler verification now uses forward confirmed reverse DNS. Fix: Unauthenticated writes to term metadata. The per category exclusion field saved raw POST data with no nonce, capability check or sanitizing. Fix: Unsanitized option writes from the settings screen. Fix: Unescaped output across the admin screens. Fix: Removed a bundled third party updater that fetched over plain HTTP. New: Enumeration protection for ?p=, oEmbed and preview endpoints. New: Audit log with salted address hashes. New: Rate limiting on the authenticated admin search endpoints. New New: Rule engine with priorities, schedules and five actions. New: Targeting by role, individual user, capability, guest or signed in state, with exceptions that always win. New: Refinement by product type, stock status, price range, SKU pattern and product attributes. New: REST API and Store API filtering. New: SEO controls. noindex on restricted pages, sitemap exclusion for WordPress core plus Yoast SEO, Rank Math, All in One SEO and SEOPress, structured data correction, breadcrumb pruning, soft 404 prevention and configurable canonicals. New: Direct access handling. Theme 404, redirect with a configurable status, sign in prompt, or an explanatory message. New: Per product overrides, plus a panel showing what every role can do. New: Live match count in the rule editor. New: Import and export of rules and settings as JSON. New: Authenticated REST API and WP-CLI commands. New: Status report naming the detected page caching layer. New: Cart enforcement. Purchasability, add to cart validation, revalidation on every cart load, removal before totals, and a checkout block. New: Page cache coordination with six caching plugins. New: HTML documentation, readable from the dashboard or straight from the folder. Changed Tweak: Rules stored in indexed tables rather than in autoloaded options. Tweak: Rule sets cached per role rather than per user whenever no rule names an individual. Tweak: Large block lists inverted into allow lists when that produces shorter SQL. Tweak: Shop managers bypass rules by default. This can be switched off to preview the catalog as a customer sees it. Tweak: Settings defined in one schema driving storage, sanitizing and the form. Fixed Fix: Fatal error in the structured data filter, which crashed every page that emits product structured data. Fix: Direct access modes never taking effect. The query filter removed the product before the template stage, so redirect, sign in, message and allow all silently behaved as if set to 404. Fix: Catalog and REST surface toggles being partly inert. Fix: Unbounded recursion when resolving rules. Fix: Variations remaining reachable when the parent product was hidden. Fix: Menu items surviving as orphans when their parent was removed. Fix: Product visibility panel reporting "visible" for roles the rules restrict. Fix: A rule aimed only at roles that bypass rules saving silently and appearing active while having no possible effect. It is now flagged before you save. Fix: Translations loading earlier than WordPress 6.7 allows. Version 6.3.3 on September 09th 2019 Tweak: Compatible with WooCommerce Product Blocks - Gutenberg Version 6.3.2 on 4th June 2019 Fix: Visibility settings not properly work in woocommerce shortcodes Version 6.3.1 on 15th May 2019 Minor Fix: Debug Warning upon certain visibility conditions Version 6.3 on 13th May 2019 Tweak: Tested with latest version of WooCommerce v3.6.2 Fix: Setting Default Values not working cause 500 Internal Server Error Fix: Reset Button not working Version 6.2 on 21st March 2019 Fix: Add to Cart issue with Variable Product Version 6.1 on 19th February 2019 Fix: Compatibility Issues with latest version of WPML Version 6.0 on 15th August 2019 Tweak: Improved Performance Fix: Slowness Issue Fixed Version 5.9 on 31st August 2018 Fix: Fetch Nested Level Child Category Ids Fix: Menu Items disappear in backend (Appearance -> Menu) Version 5.8 on 16th March 2018 New: Exclude Specific Members in Category Level Fix: Condition Break when empty array in categories Fix: Fatal Error upon activation when woocommerce is not active Version 5.7 on 30th Jan 2018 Fix: Category settings mess with variable products Version 5.6 on 17th Jan 2018 Fix: Add to Cart not working with Variable Product. Version 5.5 on 11th January 2018 New: Option to Remove Category Products Count Fix: Hiding all category instead of specific categories Version 5.4 on 09th January 2018 New: Multiple User Roles Support New: Global Visibility Settings for All Users New: Reset Option Added Tweak: PO Files Updated Version 5.3 on 05th December 2017 New: Accordion Settings and corresponding Rule Status New: PO Files Added for Translation Fix: Warning Message upon empty array Version 5.2 on 27th November 2017 New: Added All Products/Selected Products Option New: Added All Categories/Selected Categories Option Version 5.1 on 11th November 2017 New: Show/Hide Products/Categories from Navigation Menu Version 5.0 on 10th November 2017 New: Hide by Type has both Products and Categories New: Consider Child Categories of Selected Categories New: Complete Code Revamped Version 4.4 on 24th June 2017 Tweak: Enhanced code to support related products Tweak: Added support for upsells and crosssells Version 4.3 on 19th April 2017 New: Compatible with WooCommerce 3.0 Version 4.2 on 26th December 2016 Fix: Products are not hide in tag archive page Version 4.1 on 11th December 2016 Tweak: Code Improved to hide category from listing Version 4.0 on 1st December 2016 New: WPML Compatible Version 3.8 on 09th October 2016 Fix: Hide Products visible in search results. Version 3.7 on 31st August 2016 Fix: Fatal Error in Settings Page when selected products are deleted Version 3.6 on 12th August 2016 Fix: Hiding Other Custom Post Type Taxonomies Version 3.5 on 09th June 2016 - Hide Products from Ajax Product Filter (Yith) - Backend Label Updated - Screenshots & Documentation Updated Version 3.4 on 29th May 2016 - Settings UI and Label Updated - Documentation Updated Version 3.3 on 22 April 2016 Fix: Fresh Install Hide all Products and Categories Version 3.2 on 10 April 2016 Fix: Hide all Products if left the hide field empty Fix: 500 Internal Server Error on accessing settings page if more than 500+ products Tweaks: Improved code to optimize the performance of searching product in backend Version 3.1 on 08 April 2016 Tweaks: Support for Hide Product in Category Page (Updated). Version 3.0 on 07 April 2016 Tweaks: Now It hide products from site wide not alone shop page Version 2.3 on 31 October 2015 Fix: Whitespace cause header already sent problem Version 2.2 on 18 October 2015 New: Hide Products by Category Version 2.1 on 08 August 2015 - Bug Fix in WooCommerce Product Page Style - Bug Fix in Exclude Products for Guest Version 2.0 - 02 August 2015 - Bug Fix White Screen Frontend - Code Improved and Supported with WooCommerce 2.3.x - Fixed Missing Option for Guest Version 1.6 - 13 January 2015 - Added Checkbox Option for Category and Search Version 1.5 - 11 January 2015 - Hide Product in Category Page and in Search Page Version 1.4 - 5 November 2014 - For Warning array_combine is fixed Version 1.3 - 1 October 2014 - Support Show/Hide Products for Guest too. Version 1.2 - 28 September 2014 - Support with WooCommerce Latest - Support Custom User Role (From Third Party Plugins) Version 1.1 - 20 June 2014 - Fixed Minor Bug on Javascript - Improvement Made to Validating array_combine Version 1.0 - 19 June 2014 - Initial Release