diff --git a/wagtail/contrib/wagtailsitemaps/sitemap_generator.py b/wagtail/contrib/wagtailsitemaps/sitemap_generator.py
index eb08d81b7a..d22f88112e 100644
--- a/wagtail/contrib/wagtailsitemaps/sitemap_generator.py
+++ b/wagtail/contrib/wagtailsitemaps/sitemap_generator.py
@@ -8,7 +8,7 @@ class Sitemap(object):
         self.site = site
 
     def get_pages(self):
-        return self.site.root_page.get_descendants(inclusive=True).live().order_by('path')
+        return self.site.root_page.get_descendants(inclusive=True).live().public().order_by('path')
 
     def get_urls(self):
         for page in self.get_pages():
diff --git a/wagtail/contrib/wagtailsitemaps/tests.py b/wagtail/contrib/wagtailsitemaps/tests.py
index d2d612fa2a..469e210ad8 100644
--- a/wagtail/contrib/wagtailsitemaps/tests.py
+++ b/wagtail/contrib/wagtailsitemaps/tests.py
@@ -1,7 +1,7 @@
 from django.test import TestCase
 from django.core.cache import cache
 
-from wagtail.wagtailcore.models import Page, Site
+from wagtail.wagtailcore.models import Page, PageViewRestriction, Site
 from wagtail.tests.models import SimplePage
 
 from .sitemap_generator import Sitemap
@@ -23,6 +23,13 @@ class TestSitemapGenerator(TestCase):
             live=False,
         ))
 
+        self.protected_child_page = self.home_page.add_child(instance=SimplePage(
+            title="Protected",
+            slug='protected',
+            live=True,
+        ))
+        PageViewRestriction.objects.create(page=self.protected_child_page, password='hello')
+
         self.site = Site.objects.get(is_default_site=True)
 
     def test_get_pages(self):
@@ -31,6 +38,7 @@ class TestSitemapGenerator(TestCase):
 
         self.assertIn(self.child_page.page_ptr, pages)
         self.assertNotIn(self.unpublished_child_page.page_ptr, pages)
+        self.assertNotIn(self.protected_child_page.page_ptr, pages)
 
     def test_get_urls(self):
         sitemap = Sitemap(self.site)
@@ -49,6 +57,9 @@ class TestSitemapGenerator(TestCase):
         # Make sure the unpublished page didn't make it into the xml
         self.assertNotIn('/unpublished/', xml)
 
+        # Make sure the protected page didn't make it into the xml
+        self.assertNotIn('/protected/', xml)
+
 
 class TestSitemapView(TestCase):
     def test_sitemap_view(self):