Password protection and direct-link pages

Documentation / Pages and navigation

Use Direct link only for a page that should not appear through normal public navigation but may be opened by anyone who receives its address. Use Password protected when visitors must enter a shared page password.

Configure access

Open the page metadata and find Access > Availability. Select the intended option. For a password-protected page, enter a non-empty value in Password, save the settings, and test the normal page URL in a fresh signed-out browser session.

Do not leave the password field empty. The current runtime only challenges visitors when the page is marked for password protection and a password is configured. Selecting the label alone is not sufficient protection.

An accepted password grants browser access through a cookie. A browser that has already passed the challenge is therefore not a reliable test of what a first-time visitor sees. Check with a separate session when changing the configuration.

Listing is not protection

Show in navigation and collection placement affect discovery. They do not authenticate a visitor. A direct-link page can still be shared, bookmarked, or linked from another website. A future page date similarly does not stop someone from opening the address directly.

A shared page password is not an individual account system. Do not use it as evidence of person-specific permissions or assume it protects every media asset referenced by the page. Review sensitive material with the website administrator before uploading it.

Verify the locked experience, an incorrect password, and the successful destination. Confirm the page is absent from public navigation as intended.

For broader access policies, see Site administration and domains.