WordPress
wp-admin is password protected, or you can password protect frontend pages based on user registration level (very customizable with plugins, look at the plugin database for what you need). Can be done manually, donations, etc.
Vexxhost has $30/year hosting including domain.
Joomla is annoying. I've worked for multiple people in the past who required Joomla site creations and if I was given the opportunity I would have gone with WordPress every time.
/ –
