diff --git a/packages/gatsby-source-wordpress/src/gatsby-node.ts b/packages/gatsby-source-wordpress/src/gatsby-node.ts
index c9ace78fa169b..abed4d9b1155d 100644
--- a/packages/gatsby-source-wordpress/src/gatsby-node.ts
+++ b/packages/gatsby-source-wordpress/src/gatsby-node.ts
@@ -8,7 +8,9 @@ module.exports = runApisInSteps({
     steps.setErrorMap,
     steps.tempPreventMultipleInstances,
     steps.setRequestHeaders,
+    steps.hideAuthPluginOptions,
   ],
+  onPreBootstrap: [steps.restoreAuthPluginOptions],
 
   pluginOptionsSchema: steps.pluginOptionsSchema,
 
diff --git a/packages/gatsby-source-wordpress/src/steps/auth-handling.ts b/packages/gatsby-source-wordpress/src/steps/auth-handling.ts
new file mode 100644
index 0000000000000..af45942ae4990
--- /dev/null
+++ b/packages/gatsby-source-wordpress/src/steps/auth-handling.ts
@@ -0,0 +1,28 @@
+import type { GatsbyNodeApiHelpers } from "~/utils/gatsby-types"
+import type { Step } from "./../utils/run-steps"
+import type { IPluginOptions } from "~/models/gatsby-api"
+
+let storedAuthSettings: IPluginOptions["auth"] | undefined
+
+export const hideAuthPluginOptions: Step = async (
+  _helpers: GatsbyNodeApiHelpers,
+  pluginOptions: IPluginOptions
+): Promise<void> => {
+  // store auth settings so we can restore them later
+  storedAuthSettings = pluginOptions.auth
+
+  // remove auth from pluginOptions before we write out browser plugin options module,
+  // so we don't leak into the browser
+  delete pluginOptions.auth
+}
+
+export const restoreAuthPluginOptions: Step = async (
+  _helpers: GatsbyNodeApiHelpers,
+  pluginOptions: IPluginOptions
+): Promise<void> => {
+  if (storedAuthSettings) {
+    // if we stored auth settings, restore them now after we've written out browser plugin options module
+    // so engines can use them
+    pluginOptions.auth = storedAuthSettings
+  }
+}
diff --git a/packages/gatsby-source-wordpress/src/steps/index.ts b/packages/gatsby-source-wordpress/src/steps/index.ts
index d4c880185c816..1bc05f0d92dd1 100644
--- a/packages/gatsby-source-wordpress/src/steps/index.ts
+++ b/packages/gatsby-source-wordpress/src/steps/index.ts
@@ -22,3 +22,8 @@ export { logPostBuildWarnings } from "~/steps/log-post-build-warnings"
 export { imageRoutes } from "~/steps/image-routes"
 
 export { setRequestHeaders } from "./set-request-headers"
+
+export {
+  hideAuthPluginOptions,
+  restoreAuthPluginOptions,
+} from "./auth-handling"
diff --git a/packages/gatsby-source-wordpress/src/steps/process-and-validate-plugin-options.ts b/packages/gatsby-source-wordpress/src/steps/process-and-validate-plugin-options.ts
index 275ba84c594e0..e13f7e09fc0c5 100644
--- a/packages/gatsby-source-wordpress/src/steps/process-and-validate-plugin-options.ts
+++ b/packages/gatsby-source-wordpress/src/steps/process-and-validate-plugin-options.ts
@@ -167,8 +167,5 @@ export const processAndValidatePluginOptions = (
     }
   })
 
-  // remove auth from pluginOptions so we don't leak into the browser
-  delete pluginOptions.auth
-
   return userPluginOptions
 }