Protected pages

A page can be locked with a password. Visitors see a short password prompt, and once they enter the right password the page renders as usual. It suits drafts, client previews or a private gallery shared with a small group.

Try it: the page Locked is protected with the password alchemy.

Locking a page

Add a secret property to the frontmatter:

---

title: Client preview

secret: alchemy

---

Everything the page would show is withheld until it is unlocked: the markdown content, a banner, an images gallery, an iframe, a deck or onesheet layout and a linked Bluesky discussion. The server sends it to the browser only after the password has been checked; the initial server-rendered HTML that crawlers receive holds the prompt alone.

The password is compared as text. Quote it in the frontmatter if it looks like a number or contains special characters:

---

secret: "1234"

---

Staying unlocked

After a successful unlock, the browser stores the password in its session storage. Every time the page is opened again, the stored password is sent along and checked on the server before anything is rendered. Because of this:

  • The page stays unlocked while navigating the site, including after a LiveView reconnect, and revisits render the content directly.
  • Closing the tab forgets the password. Every tab starts locked.
  • Changing or removing secret in the frontmatter immediately locks the page again for everyone, because the stored password then fails the check.

Security notes

  • The password check is a constant-time comparison with a small delay per attempt, which makes guessing slow. Attempts are unlimited, so pick a long password.
  • The password lives in plain text in the markdown file. Keep the pages directory out of public repositories if that matters.
  • The page title is still listed in the menu and, for dated posts, in the RSS feed. Combine secret with hidden: true to keep the page out of both, as the Locked page does.
  • Once unlocked, the content is ordinary HTML in the browser. It keeps casual visitors out; anyone with the password can copy the content.