> ## Documentation Index
> Fetch the complete documentation index at: https://docs.shipways.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Password protection

> Putting a prompt in front of a whole site.

HTTP basic authentication in front of everything the site serves. Nginx asks
for it, so the application never sees an unauthenticated request at all.

The usual reason is a staging site that should not be indexed or wandered into.

## Adding somebody

A username and a password. Shipways keeps the **hash** and not the password, so
it can never be shown again — saving over a name that already exists is how you
change one.

Removing a user means they can no longer get past the prompt.

## What it does and does not cover

It covers every request nginx serves for the site, including assets and API
routes. Anything that talks to the site over HTTP needs the credentials, which
in practice means webhooks and monitoring will break unless they carry them.

It does not cover anything reaching the application another way — a queue
worker, a scheduled job, or a database client.

The [deploy health check](/sites/deployments#the-two-checks) is unaffected: it
asks the site for a page from the machine itself.

## Basic auth is not encryption

Credentials go over the wire on every request. On a site with no
[certificate](/sites/certificates) they go in clear text. Request one first.

## The alternative

If what you want is "nobody but us, for now" rather than "these particular
people", [maintenance mode](/sites/maintenance) with its bypass link is usually
the better fit: one link, rotated each time, and no accounts to clean up
afterwards.