How to put a password on a site

Steps

1. Pick where the gate lives

   The gate runs in one of four places. The choice depends on who serves your site.

   Method	Who runs it	Visitors see	Cost
   nginx basic auth	You, on your server	The browser's login box	Free
   Caddy basic auth	You, on your server	The browser's login box	Free
   Cloudflare Access	Cloudflare, in front of your site	A login page, for example with a one-time code by email	Cloudflare Zero Trust has a Free plan
   Netlify	Netlify, a site setting	A password page	Paid plan
   Uno	Uno, a switch on the site	A password page	Free

2. nginx: make a password file

   The file takes crypt(), apr1 (Apache MD5) or {SCHEME} hashes; htpasswd or openssl passwd make them. The htpasswd tool comes in the apache2-utils package on Ubuntu. It asks for the password twice and stores only a hash.

   $ sudo apt install -y apache2-utils
   $ sudo htpasswd -c /etc/nginx/.htpasswd client

3. nginx: add the gate to the site

   auth_basic sets the prompt text; auth_basic_user_file points to the file with names and password hashes. Put both in the location you want to close, then test the config and reload.

   location / {
       auth_basic           "closed site";
       auth_basic_user_file /etc/nginx/.htpasswd;
   }
   
   $ sudo nginx -t && sudo systemctl reload nginx

4. Caddy: hash the password and add a block

   Caddy's directive is basic_auth, with a username and a hashed password in a block. The hash is bcrypt by default, and caddy hash-password makes it. Paste the hash, not the password.

   $ caddy hash-password
   Enter password: ········
   $2a$14$Zkx19XLiW6VYouLHR5NmfOFU0z2GTNmpkT/5qqR7hx4IjWJPDhjvG
   
   example.com {
       basic_auth {
           client $2a$14$Zkx19XLiW6VYouLHR5NmfOFU0z2GTNmpkT/5qqR7hx4IjWJPDhjvG
       }
       root * /var/www/site
       file_server
   }

5. On a host: use its setting

   Cloudflare Access. Cloudflare Access decides who can reach an application by applying the policies you configure. Add your site as an application, then write a policy that allows the people you name. A policy that includes everyone with a valid email login lets in anyone who can receive a one-time PIN; list the exact addresses instead.

   Netlify. A site-wide shared password needs a Netlify Pro plan or higher; it is not on the Free plan.

6. Share the password the safe way

   Send it in a different channel from the link: the link by email, the password in a messenger. Use a long one that you use nowhere else. If a person leaves, change the password.

Check that it works

Ask for the page with no password, then with one. A closed site answers 401 to the first request and 200 to the second.

$ curl -sI https://example.com/ | head -1
HTTP/2 401
$ curl -sI -u client https://example.com/ | head -1
Enter host password for user 'client':
HTTP/2 200

Check HTTPS too. Basic auth sends the password with every request, so over plain http anyone on the network can read it.

In Uno: a switch, or one sentence

Uno puts the gate on the published copy. Visitors see a password page; after the right password the browser remembers it for 7 days, and a new password signs everyone out. You set the password in three ways:

1. Ask the agent

   "Put a password on my site." site_set_password: you give a password, or the agent generates a readable one and tells you.

2. Use the console

   Open the site, go to the Password tab and turn the switch on. The tab suggests a password and has a Copy button.

3. Call the API

   PUT /api/v1/deploys/{slug}/password with the password in the body. An empty password removes the lock.

$ curl -s -H "Authorization: Bearer $UNO_API_KEY" -X PUT \
    https://console.uno.place/api/v1/deploys/my-cafe/password \
    -d '{"password":"a-long-passphrase-here"}'

A password is 10 to 128 characters long. For an office or a VPN, you can also let in only chosen IP addresses.

Visitors type it

Once per browser for 7 days

Change it

Everyone signs in again

Remove it

Switch off, or send an empty password

What a password does not do

• It is one shared password, not accounts. You cannot tell who opened the page, or close it for one person. For that you need logins, which means server code or a service such as Cloudflare Access.
• Whoever has the password sees everything on the site. Keep keys, .env files and customer data out of the folder anyway.
• Basic auth has no "log out" and no limit on guesses unless you add one. A long password is the defence.
• On Uno a new password signs everyone out. That is the way to lock out a person who had the old one.

Common problems