How to password protect a website (and when you should)

Not every website is meant for everyone. Sometimes you need a page that only a client, a team or a guest list can see — without building a login system.

When a site password is the right tool

• Client previews before launch.
• Internal documentation or a team wiki.
• Investor or sales decks shared as a link.
• Private events — weddings, reunions, workshops.
• Unreleased products and press kits under embargo.

A single shared password is perfect when the audience is small and you trust them with the same key. If you need individual accounts, permissions or the ability to revoke one person’s access, you need a real authentication system.

Why JavaScript “passwords” don’t work

You’ll find tutorials that hide content with a JavaScript prompt. Don’t use them: the content is still sent to the browser and anyone can read it with “View source”.

Real protection has to happen on the server, before any of your files are sent.

How StaticHero password protection works

1. A visitor requests any page on your site.
2. The server checks for a valid access cookie. Without one, it shows a password page instead of your content — none of your files are sent.
3. When the correct password is entered, the server sets a signed, HTTP-only cookie for that site and shows the page they asked for.
4. Changing the password invalidates every existing cookie.

Passwords are stored as one-way hashes, and protected sites automatically send a noindex header so search engines don’t list them.

Setting it up

1. Open your site in the StaticHero dashboard.
2. Go to Settings → Password protection.
3. Choose a password and save.

Share the link and the password through different channels — for example, the link by email and the password by text message.

Combine with expiry

For time-limited sharing, set an expiry date in the same settings page. After that moment the site shows an “expired” message, even to people with the password. It’s ideal for proposals, limited offers and event pages.

Good password hygiene for shared sites

• Use a phrase, not a word: copper-lantern-river beats client2026.
• Change it after a project ends or someone leaves the team.
• Don’t reuse a password you use anywhere else.

A password won’t replace an access-control system, but for the many cases where “just the people I sent it to” is the requirement, it’s exactly enough.