If this will only be for yourself and perhaps a couple other people, you can use Apache to password-protect the entire WordPress site. This is far better than using a WP plugin since it protects EVERYTHING, not just access to your site’s pages.
There is a wealth of documentation available that explains how to do this. Here is the “official” Apache documentation, which is kinda technical:
https://httpd.apache.org/docs/2.4/howto/auth.html
I’m sure your hosting company has documentation available as well. Hosting control panels such as cPanel, Plesk, and DirectAdmin have options that automate the process.