protect part website with password

I have a blog. It is public. But I also have pictures in a separate section that I only want to be available for friends and family who I give a password.

I used the standard password option on a page in wordpress. But when I’m behind this page. Let’s say watching a picture, It is possible to send the permalink to someone else and then this person ‘gets in’ without having to enter the password. How can I fix this?

Or is it best to replace the pictures in an subdomain and secure that?