diff --git a/backend/api/cms/page/queries/cms_pages.py b/backend/api/cms/page/queries/cms_pages.py
index 6fcf6437af..1aed1f84a2 100644
--- a/backend/api/cms/page/queries/cms_pages.py
+++ b/backend/api/cms/page/queries/cms_pages.py
@@ -15,6 +15,6 @@ def cms_pages(hostname: str, language: str) -> list[GenericPage]:
     return [
         GenericPage.from_model(page)
         for page in GenericPageModel.objects.in_site(site).filter(
-            locale__language_code=language, live=True
+            locale__language_code=language, live=True, view_restrictions__isnull=True
         )
     ]
diff --git a/backend/api/cms/tests/page/queries/test_cms_pages.py b/backend/api/cms/tests/page/queries/test_cms_pages.py
index b9be571224..d7c3d5076b 100644
--- a/backend/api/cms/tests/page/queries/test_cms_pages.py
+++ b/backend/api/cms/tests/page/queries/test_cms_pages.py
@@ -1,3 +1,4 @@
+from wagtail.models import PageViewRestriction
 import pytest
 from api.cms.tests.factories import GenericPageFactory, SiteFactory
 
@@ -48,6 +49,49 @@ def test_pages(graphql_client, locale):
     }
 
 
+def test_restricted_pages_are_not_returned(graphql_client, locale):
+    parent = GenericPageFactory()
+    parent.save_revision().publish()
+    page_1 = GenericPageFactory(
+        slug="bubble-tea",
+        locale=locale("en"),
+        parent=parent,
+        body__0__text_section__title__value="I've Got a Lovely Bunch of Coconuts",
+    )
+    page_1.save_revision().publish()
+    PageViewRestriction.objects.create(
+        page=page_1, restriction_type="password", password="ticket"
+    )
+
+    page_2 = GenericPageFactory(
+        slug="chocolate",
+        locale=locale("en"),
+        parent=parent,
+        body__0__text_section__title__value="There they are, all standing in a row",
+    )
+    page_2.save_revision().publish()
+    SiteFactory(hostname="pycon", port=80, root_page=parent)
+
+    query = """
+    query Page ($hostname: String!, $language: String!) {
+        cmsPages(hostname: $hostname, language: $language){
+            id
+        }
+    }
+    """
+
+    response = graphql_client.query(
+        query, variables={"hostname": "pycon", "language": "en"}
+    )
+
+    assert response["data"] == {
+        "cmsPages": [
+            {"id": str(parent.id)},
+            {"id": str(page_2.id)},
+        ]
+    }
+
+
 def test_pages_site_not_found(graphql_client):
     query = """
     query Page ($hostname: String!, $language: String!) {