Password-protect a site

Sometimes a site isn’t ready for the world yet: you’re showing a draft to a client, staging a launch, or sharing something only with your team. Bailey lets you put one shared password in front of the whole site.

Turn it on

Open your project → Settings → Password protection → Protect with a password. Type a password (at least 4 characters) and save. From now on, anyone opening your address sees a simple unlock screen first.

Everyone you share with uses the same password. There are no individual visitor accounts.

Change or remove it

In the same place you can:

• Change password: set a new one anytime.
• Remove protection: the site becomes public again (with a confirmation, so you don’t do it by accident).

What it protects, and what it doesn’t

The password covers your whole published site: the home page and every image, style, and file behind it. There’s no back door through a direct file link.

It’s a soft lock, not a vault

A single shared password is great for “don’t show this publicly yet”. It is not the right tool for genuinely sensitive data: there are no per-person accounts, and anyone you share the password with can pass it on. For private personal data, don’t rely on this alone.

This protects your published site (your visitors). It has nothing to do with logging into your Bailey dashboard; that’s always your own account.

---

For developers

The password is hashed with PBKDF2-HMAC-SHA256 (600,000 iterations, per-site salt); the plaintext is never stored and the hash is never returned by the API. Unlock state is a signed, host-only cookie bound to the site’s internal id, HttpOnly + Secure + SameSite=Lax, 7-day TTL, so unlocking one site never unlocks another. Unlock attempts are rate-limited per IP. See the Security model.