Directory Privacy: protect a staging area with browser authentication

Directory Privacy can place HTTP authentication in front of a selected directory. It is useful for restricted previews, but is separate from your application’s own login and permissions.

Protect the correct destination

1. Confirm the staging document root in Domains.
2. Open Directory Privacy and navigate to that exact directory.
3. Enable protection, choose a clear description and create access credentials privately.
4. Test the staging URL in a fresh private browser session. Confirm that the production website remains accessible as intended.
5. Share access only with authorised reviewers and remove it when no longer needed.

Check side effects

Server authentication can block webhooks, monitoring, external previews and certificate-validation requests. Ask support about necessary exceptions; do not broadly disable protection to make one integration work.

A noindex tag or robots.txt rule is not an access-control substitute. Conversely, authentication does not remove sensitive data already copied into staging backups or logs.

Keep HTTPS active so credentials travel over encryption. Before launch, plan which protection will be removed, which application logins remain and how indexing settings will change. Re-test forms and integrations after the transition.