Ok, so I found where the issue was.
In the settings section, my WordPress address was https://www.lushwebsites.com/4mulaevents and my site address was https://www.4mulaevents.ca
If both addresses are set to the same, the password protect works fine. When I change it, it doesn’t work.
The problem is, I want the addresses to be different.
So does anyone have any tips on how to fix this?