WordPress Password Protected Page is not protected

Im not sure about your specific theme but by default when you select password protected, it only hides the content. i.e. the_content(). Therefore, if you wanted to password protect the whole page, update you php to something similiar to the below:

<?php

global $post;
get_header();

if ( post_password_required( $post ) ) {
      // Password protecte content.
}else{
    // Page isn't password-protected, show password prompt
    echo get_the_password_form( $post );
}

?>