WooCommerce Hide Products decides what each visitor is allowed to see in your catalog. Build a rule from four plain parts: who it applies to, what it covers, what it does, and optionally when it runs. Everything else exists to make sure that rule is actually enforced, everywhere, and that search engines are told something coherent about the result.

Version 10.0 is a complete rewrite. New rule engine, new admin experience, hardened query layer, and full REST and Store API coverage. Your existing settings are imported automatically and the originals are left untouched.

What a rule can do

Hide from the catalog – removed from listings, search, menus, feeds and the API
Show only these items – build a restricted catalog from a whitelist
Hide the price – product stays visible and indexable, price is replaced
Block purchasing – catalog mode for a role, a region or an approval flow
Require a signed in account – members only products

Who a rule can target

User roles, including custom roles from any membership or role plugin
Guests – visitors who are not signed in are a first class audience
Individual users by name or email
Anyone holding a capability
Everyone, or any signed in user
Exceptions that always win – exempt named users or roles from any rule
Multiple user roles resolved by a priority order you control

What a rule can cover

Products, categories and tags are added together. Then these narrow the selection rather than widening it, so everything in Wholesale over 100 that is still in stock is one rule, not four:

Product type – simple, variable, grouped, external, plus any type an extension registers
Stock status – in stock, out of stock, on backorder
Price range – compared against the active price, so a sale price is what counts
SKU pattern – wildcards, for example WHOLESALE-*
Product attributes
Child categories of the parents you chose, at any depth
Never include these products – one exception inside an otherwise correct rule

Where the rules are enforced

Removing a product from the shop page is presentation. Enforcement means every way of reaching that product agrees:

Shop, category, tag and search pages
Site search and product suggestions
Navigation menus, pruning descendants along with their parent
Related products, upsells, cross sells and grouped children
Product shortcodes and WooCommerce blocks
RSS and Atom feeds
The WordPress REST API, the WooCommerce REST API and the Store API
oEmbed and preview endpoints
The cart, revalidated on every load and again at checkout
XML sitemaps and structured data

Why the API layer matters more than it sounds. A modern WooCommerce store answers on /wp-json/wc/store/v1/products, which is public by design and returns catalog data with no template code running. A plugin that filters only the main query hides a product from the shop page while leaving it fully readable at that URL, to anyone, with no authentication. That single gap voids every rule. This plugin closes it by default, and the built in status report warns you if it is ever switched off.

Built for SEO, not against it

Restricting a catalog and ranking well are not in conflict, but they interact in ways that are easy to get wrong. The position this plugin takes is that a gated page should be honest and excluded, not clever and indexed.

Crawlers see the guest view by default, so what is indexed and what is public stay in agreement
noindex, follow on restricted pages – keeps thin gate pages out of the index while link equity still flows through to the pages that are public
Dropped from XML sitemaps – WordPress core plus Yoast SEO, Rank Math, All in One SEO and SEOPress. Sitemaps are always built against the guest policy, never against whoever requested the file
Structured data is corrected – when a price is hidden the Offer is removed, because marking up a price the visitor cannot see is a structured data policy violation, not merely untidy
Breadcrumbs pruned – no dead internal links and no false BreadcrumbList claims
Real 404 instead of a soft 404 – a page that says “not available” while returning HTTP 200 wastes crawl budget
Configurable canonicals, defaulting to leaving them alone

Choosing the right tool matters: hide removes the page from the index, while hide price and block purchasing keep the page indexable and keep its inbound links working. For most wholesale stores the second is what you actually want.

Security

Every database statement is prepared. Identifier lists are bound through $wpdb->prepare() with placeholders generated from a count, never concatenated
Nonce, then capability, then rate limit on every state changing request
Verified crawler detection using forward confirmed reverse DNS, the method every major search engine documents. A User-Agent header alone proves nothing and is never trusted by default
Forwarding headers ignored unless the site declares it sits behind a trusted proxy
Audit log of every rule change, storing a salted hash of the client address rather than the address itself
No unauthenticated AJAX handler and no public REST route anywhere in the plugin
Uploaded import files are confirmed as genuine uploads, size capped, depth limited on decode and validated field by field

Built in tooling

Live match count in the rule editor, so you can see how many products a rule covers before you save it
Per product panel showing exactly what every role can do with that product: full access, hidden, no price, cannot buy or must sign in
Per product overrides for the one item that needs an exception
Status report naming the page caching layer it detected and what that means for rule enforcement
Import and export of rules and settings as JSON, for moving a configuration between staging and production
Audit log of who changed which rule and when
Scheduling – run a rule between two dates and it takes effect and expires on its own

For developers

More than twenty documented filters and fourteen actions
A full authenticated REST API under cwgpv/v1
WP-CLI commands, including wp cwgpv preview --user=42 to check exactly what one account can see, and wp cwgpv doctor for a configuration audit. Both are safe to run in CI
PSR-4 style autoloading, one policy object per request, and a translation ready codebase with a bundled POT file

Compatibility

WPML and Polylang – select only the parent product or category and every translation is covered automatically
All WooCommerce product types, with variations covered when the parent is restricted
High Performance Order Storage and the block based cart and checkout, both declared compatible
YITH Ajax Product Filter and Ajax Search
WooCommerce product blocks in the block editor
Page cache coordination with WP Rocket, W3 Total Cache, WP Super Cache, LiteSpeed, WP Engine and SiteGround Optimizer
Any standard theme that supports WooCommerce

Requirements

WordPress 6.0 or newer
WooCommerce 6.0 or newer
PHP 7.4 or newer, 8.1 or newer recommended
A persistent object cache such as Redis or Memcached is recommended but not required

Need of assistance?

Complete documentation ships inside the download. Open the documentation folder and load index.html in your browser, or read it without leaving your dashboard at Visibility → Documentation. It covers setup, how overlapping rules resolve, every setting explained, search engine behaviour, page caching, the developer reference and troubleshooting.

If you need help to configure, customize or make something compatible, we are here to help. Feel free to contact us.

Updates

Version 10.0.0 on 20th August 2026
A complete rewrite. New architecture, new data model, new admin experience.
Existing settings are imported automatically and the originals are left in place.

Security
Fix: SQL injection in the catalog query filter. Identifiers were concatenated
     into the WHERE clause over values that had never been cast to integers.
     All statements are now prepared.
Fix: SQL injection in the taxonomy clause filter, which had the same defect.
Fix: Complete access control bypass. Search engine detection matched the
     User-Agent header and granted matching requests an unrestricted view of
     the catalog. That header is chosen by the client, so any visitor sending
     "Googlebot" could read every hidden product. Crawler verification now uses
     forward confirmed reverse DNS.
Fix: Unauthenticated writes to term metadata. The per category exclusion field
     saved raw POST data with no nonce, capability check or sanitizing.
Fix: Unsanitized option writes from the settings screen.
Fix: Unescaped output across the admin screens.
Fix: Removed a bundled third party updater that fetched over plain HTTP.
New: Enumeration protection for ?p=, oEmbed and preview endpoints.
New: Audit log with salted address hashes.
New: Rate limiting on the authenticated admin search endpoints.

New
New: Rule engine with priorities, schedules and five actions.
New: Targeting by role, individual user, capability, guest or signed in state,
     with exceptions that always win.
New: Refinement by product type, stock status, price range, SKU pattern and
     product attributes.
New: REST API and Store API filtering.
New: SEO controls. noindex on restricted pages, sitemap exclusion for
     WordPress core plus Yoast SEO, Rank Math, All in One SEO and SEOPress,
     structured data correction, breadcrumb pruning, soft 404 prevention and
     configurable canonicals.
New: Direct access handling. Theme 404, redirect with a configurable status,
     sign in prompt, or an explanatory message.
New: Per product overrides, plus a panel showing what every role can do.
New: Live match count in the rule editor.
New: Import and export of rules and settings as JSON.
New: Authenticated REST API and WP-CLI commands.
New: Status report naming the detected page caching layer.
New: Cart enforcement. Purchasability, add to cart validation, revalidation on
     every cart load, removal before totals, and a checkout block.
New: Page cache coordination with six caching plugins.
New: HTML documentation, readable from the dashboard or straight from the folder.

Changed
Tweak: Rules stored in indexed tables rather than in autoloaded options.
Tweak: Rule sets cached per role rather than per user whenever no rule names
       an individual.
Tweak: Large block lists inverted into allow lists when that produces
       shorter SQL.
Tweak: Shop managers bypass rules by default. This can be switched off to
       preview the catalog as a customer sees it.
Tweak: Settings defined in one schema driving storage, sanitizing and the form.

Fixed
Fix: Fatal error in the structured data filter, which crashed every page that
     emits product structured data.
Fix: Direct access modes never taking effect. The query filter removed the
     product before the template stage, so redirect, sign in, message and allow
     all silently behaved as if set to 404.
Fix: Catalog and REST surface toggles being partly inert.
Fix: Unbounded recursion when resolving rules.
Fix: Variations remaining reachable when the parent product was hidden.
Fix: Menu items surviving as orphans when their parent was removed.
Fix: Product visibility panel reporting "visible" for roles the rules restrict.
Fix: A rule aimed only at roles that bypass rules saving silently and appearing
     active while having no possible effect. It is now flagged before you save.
Fix: Translations loading earlier than WordPress 6.7 allows.

Version 6.3.3 on September 09th 2019
Tweak: Compatible with WooCommerce Product Blocks - Gutenberg

Version 6.3.2 on 4th June 2019
Fix: Visibility settings not properly work in woocommerce shortcodes

Version 6.3.1 on 15th May 2019
Minor Fix: Debug Warning upon certain visibility conditions

Version 6.3 on 13th May 2019
Tweak: Tested with latest version of WooCommerce v3.6.2
Fix: Setting Default Values not working cause 500 Internal Server Error
Fix: Reset Button not working

Version 6.2 on 21st March 2019
Fix: Add to Cart issue with Variable Product

Version 6.1 on 19th February 2019
Fix: Compatibility Issues with latest version of WPML

Version 6.0 on 15th August 2019
Tweak: Improved Performance
Fix: Slowness Issue Fixed

Version 5.9 on 31st August 2018
Fix: Fetch Nested Level Child Category Ids
Fix: Menu Items disappear in backend (Appearance -> Menu)

Version 5.8 on 16th March 2018
New: Exclude Specific Members in Category Level
Fix: Condition Break when empty array in categories
Fix: Fatal Error upon activation when woocommerce is not active

Version 5.7 on 30th Jan 2018
Fix: Category settings mess with variable products

Version 5.6 on 17th Jan 2018
Fix: Add to Cart not working with Variable Product.

Version 5.5 on 11th January 2018
New: Option to Remove Category Products Count
Fix: Hiding all category instead of specific categories

Version 5.4 on 09th January 2018
New: Multiple User Roles Support
New: Global Visibility Settings for All Users
New: Reset Option Added
Tweak: PO Files Updated

Version 5.3 on 05th December 2017
New: Accordion Settings and corresponding Rule Status
New: PO Files Added for Translation
Fix: Warning Message upon empty array

Version 5.2 on 27th November 2017
New: Added All Products/Selected Products Option
New: Added All Categories/Selected Categories Option

Version 5.1 on 11th November 2017
New: Show/Hide Products/Categories from Navigation Menu

Version 5.0 on 10th November 2017
New: Hide by Type has both Products and Categories
New: Consider Child Categories of Selected Categories
New: Complete Code Revamped

Version 4.4 on 24th June 2017
Tweak: Enhanced code to support related products
Tweak: Added support for upsells and crosssells

Version 4.3 on 19th April 2017
New: Compatible with WooCommerce 3.0

Version 4.2  on 26th December 2016
Fix: Products are not hide in tag archive page

Version 4.1 on 11th December 2016
Tweak: Code Improved to hide category from listing

Version 4.0 on 1st December 2016
New: WPML Compatible

Version 3.8 on 09th October 2016
Fix: Hide Products visible in search results.

Version 3.7 on 31st August 2016
Fix: Fatal Error in Settings Page when selected products are deleted

Version 3.6 on 12th August 2016
Fix: Hiding Other Custom Post Type Taxonomies

Version 3.5 on 09th June 2016
- Hide Products from Ajax Product Filter (Yith)
- Backend Label Updated
- Screenshots & Documentation Updated

Version 3.4 on 29th May 2016
- Settings UI and Label Updated
- Documentation Updated

Version 3.3 on 22 April 2016
Fix: Fresh Install Hide all Products and Categories

Version 3.2 on 10 April 2016
Fix: Hide all Products if left the hide field empty
Fix: 500 Internal Server Error on accessing settings page if more than 500+ products
Tweaks: Improved code to optimize the performance of searching product in backend

Version 3.1 on  08 April 2016
Tweaks: Support for Hide Product in Category Page (Updated).

Version 3.0 on 07 April 2016
Tweaks: Now It hide products from site wide not alone shop page

Version 2.3 on 31 October 2015
Fix: Whitespace cause header already sent problem

Version 2.2 on 18 October 2015
New: Hide Products by Category

Version 2.1 on 08 August 2015
- Bug Fix in WooCommerce Product Page Style
- Bug Fix in Exclude Products for Guest

Version 2.0 - 02 August 2015
- Bug Fix White Screen Frontend
- Code Improved and Supported with WooCommerce 2.3.x
- Fixed Missing Option for Guest

Version 1.6 - 13 January 2015
- Added Checkbox Option for Category and Search

Version 1.5 - 11 January 2015
- Hide Product in Category Page and in Search Page

Version 1.4 - 5 November 2014
- For Warning array_combine is fixed

Version 1.3 - 1 October 2014
- Support Show/Hide Products for Guest too.

Version 1.2 - 28 September 2014
- Support with WooCommerce Latest
- Support Custom User Role (From Third Party Plugins)

Version 1.1 - 20 June 2014
- Fixed Minor Bug on Javascript
- Improvement Made to Validating array_combine

Version 1.0 - 19 June 2014
- Initial Release

WooCommerce Hide Products | Products, Categories Visibility by User Roles