Updated 1 November 2026

How to password protect a website

By João Saraiva

A password only protects a website if the server checks it before it sends the page. Every way below does. They differ in what they cost, whether everyone shares one password or each person signs in, and what still gets through.

Where the password has to be checked

If the check runs in the page, as a few lines of JavaScript, the page has already arrived, and so has everything on it: View Source shows it. Why a password in the page isn't one.

A real check happens on the server. Without the password, the server sends a form instead of the page, and a search engine sees only the form too.

Three questions tell the ways below apart: can you protect the whole website or one page, does everyone share one password or does each person sign in, and do uploaded files, like images and PDFs, stay reachable at their own address.

On WordPress, Squarespace or Wix

• WordPress. One post or page at a time, free: in its settings, set Visibility to Password protected. Everyone shares that page's password, up to 20 characters, and the browser keeps it for 10 days. WordPress's own documentation describes no password for the whole website; plugins add one. WordPress.com's help says files added to a protected post can still be opened, and indexed, without it.
• Squarespace. The whole website, under Site Availability → Password Protected, or single pages, in the page's settings under Password. Everyone shares the same password, and a visitor is asked again after four hours. With a password on the whole website, customers can't check out.
• Wix. Single pages, in the page's settings under Access → Password holders. Wix's help says a password for the whole website is not yet available to everyone, and that code on a protected page can still be read in the browser.

On Netlify, Vercel or GitHub Pages

• Netlify. A password for the whole website on Pro, at $20 a month; not on Free or Personal. Pro can also put a name and password on chosen paths, in the _headers file.
• Vercel. A shared password on Pro, at $20 a month for each protected project, and it covers your live domain only with the All Deployments scope. Vercel Authentication, free on every plan, lets in only people with a Vercel account you have given access.
• GitHub Pages. No password. A Pages site is public even when its repository is private; only GitHub Enterprise Cloud can make it private, to people who can read the repository.

Any website: an email code with Cloudflare Access

If your domain is on Cloudflare, Access can stand in front of any website. A visitor types their email, gets a code that works once and lasts 10 minutes, and gets in only if you listed that address. It is free for up to 50 people, then $7 a person a month.

There is no password to pass around, and you can take one person off the list. The catch, in Cloudflare's own guide: anyone who finds your server's own address can go around Cloudflare, so put the server behind a Cloudflare Tunnel.

Your own server: a password in Apache or nginx

On a server of your own, the web server can ask for a name and password by itself. Make a password file outside the folder the website is served from, with a line for each person:

htpasswd -c /etc/.htpasswd ana

Then, for Apache, in the website's configuration or in a .htaccess file in the folder to protect:

AuthType Basic
AuthName "Private"
AuthUserFile "/etc/.htpasswd"
Require valid-user

For nginx, in the server block, or in a location for one part:

auth_basic "Private";
auth_basic_user_file /etc/.htpasswd;

Each person gets a name and password of their own. The password travels with every request, unencrypted, so use it only over HTTPS, as Apache's guide says.

A page, folder or PDF you have: Solta

If what you want to protect is a page, a folder or a PDF rather than a website you already run, put it on Solta and choose Password under who can open it. It is on every plan: 1 site with a password at a time on Free, 5 on Plus and as many as you like on Pro and Team.

The password is checked before anything is sent: no page, no image, no PDF. We keep only an scrypt hash of it, and the right password opens that one site for 12 hours. A site behind a password is also kept out of search engines, like every site that isn't Public. How Solta keeps sites out of search.

If one shared password isn't enough, Invited, on Pro and Team, lets in only the addresses you list, each confirmed by email once, with no account.

Which one to use

• A post or page on a WordPress website: WordPress's own password, and keep the files that matter elsewhere.
• A whole website on Squarespace: its password for the whole website, unless you sell there.
• A website you host yourself, for a few named people: Cloudflare Access, or a password in Apache or nginx over HTTPS.
• A page, a folder or a PDF to send to someone: Solta, with a password, or invited addresses on Pro and Team.

Sources

Each company's facts are what its own pages said when we read them, on 1 November 2026:

• WordPress: protect posts with a password, and how long the password is kept
• WordPress.com: post and page visibility
• Squarespace: site-wide passwords and page passwords
• Wix: a password on one page and on the whole website
• Netlify: password protection and basic authentication in headers
• Vercel: password protection, deployment protection and Vercel Authentication
• GitHub: creating a Pages site and private Pages visibility
• Cloudflare: Zero Trust plans, one-time PIN and protecting a public website
• Apache: authentication and authorization and nginx: auth_basic

Questions