How to password protect a website, host by host.

GitHub Pages

GitHub Pages has no password setting. Its only access control is private publishing, and that needs GitHub Enterprise Cloud: a privately published site can only be opened by people with read access to the repository it is published from, which means a GitHub account and a seat in your organization. Otherwise the site is public to anyone who has the address, even when the repository is private.

That works for an internal docs site for your own engineers. It does not work for a client, a contractor or anyone else you would rather not add to your GitHub organization. What private Pages costs, and the alternative.

Google Sites

Google Sites has no password option. In the Share dialog you set "Published site" to Restricted and then add people or groups by email with the Published viewer role. Access works the way sharing a Google Doc does: by person, through their Google account, rather than with one password you hand out. If your organization uses Google Workspace, an administrator may limit these options further.

Notion

Notion has no password option. Its help page answers "Can I password protect a page?" with "Unfortunately, not at the moment." A page published with Notion Sites can be viewed by anyone on the web, and its subpages are published with it unless you restrict them. For private sharing, Notion's answer is to invite people who have Notion accounts. If the page carries an HTML block you want to share outside Notion, the same limit applies.

Netlify

Netlify has a shared site password, on paid plans only. On its current credit-based plans, password protection is not available on Free or Personal (there, making a project private means only the team owner can see it). On credit-based Pro, a shared password is one of the Project visibility options, alongside public and private. Legacy Pro and Enterprise plans keep the older Password Protection settings, and Enterprise adds team login.

Vercel

Vercel's Password Protection asks visitors for one password you set. On Pro it costs $20 a month for each protected project; Enterprise includes it for every project; Hobby does not have it. Visitors enter the password once per deployment, and again whenever you change it.

Cloudflare Pages

Cloudflare Pages has no password setting. What it has is Cloudflare Access, which puts a sign-in in front of the site. One of its login methods is a one-time PIN sent by email to addresses you allow, so no identity provider is needed. Turned on from the Pages project, Access covers preview deployments only; covering the pages.dev address and a custom domain takes extra setup in Cloudflare's Zero Trust dashboard. Cloudflare Zero Trust is free for up to 50 users.

WordPress and Squarespace

WordPress gives every post and page a Password Protected visibility setting, so you can lock pages one at a time. Locking the whole site is not part of core WordPress; it takes a plugin, or server rules you write yourself. Squarespace has both kinds built in: a site-wide password under Site Availability, and passwords on individual pages. Everyone shares the one password, a visitor's session lasts four hours, and store checkout stops working while the site-wide password is on.

On a server you run

If the site sits on Apache or nginx you control, HTTP basic auth (an .htaccess file on Apache, auth_basic on nginx) puts the browser's own password dialog in front of it, for free. It needs HTTPS, it has no expiry or record of who opened what, and static hosts do not run .htaccess. A JavaScript prompt that hides the content is not protection at all: the page still arrives in the browser. Every way to password protect a single HTML page covers these in detail.

When your host has no password option

Move the files to a host where the password is a setting rather than a project. On Stacktree:

1. Upload the site. Drag the .html file onto the Stacktree dashboard, or a .zip of the whole site with its pages and images. An AI assistant connected to Stacktree can publish it for you.
2. Set a passcode. Add a passcode when you publish, or later from the dashboard. It covers every file on the site, and the link does not change.
3. Send the link and the passcode. Visitors type the passcode once and stay in for 30 days on that browser. Change or remove it at any time.

The passcode is stored as a hash, never in plaintext, and the dashboard can show it again when you need to resend it. It sits on top of an address that is already private: every Stacktree site lives at an unguessable link that is never listed and never indexed, so holding the link and knowing the passcode are two separate things a visitor needs. Visitors type it on a plain page in their browser, with no account to create. What the visitor sees.

A password, an email check, or an expiry date

• Passcode. One secret for a client or a small group. On every plan, including Free (3 pages) and pages published without an account.
• Email check. Admit a company domain such as @yourclient.com, named people such as jane@yourclient.com, or both, up to 20 entries. Each visitor proves the address with a one-time link sent by email. A page carries a passcode or an email check, not both. From Solo, $19 a month.
• Expiry. The site stops opening at a time you choose. Free pages last 7 days, or once someone else opens one, 30 days after their latest visit, up to 90 days in total. On paid plans you choose any length, or never.

Paid plans also put the site on your own domain and remove the Stacktree badge. For a client who gets more than one site from you, a client space puts them all behind one passcode they type once. Full detail on pricing.