---
title: "Academy Article"
canonical_url: "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch"
locale: en
meta:
"og:title": "Academy Article"
---
[Go to home](https://academy.laioutr.com/en)
- [Hosting and operations](https://academy.laioutr.com/en/bereiche/hosting-and-operations)
- [Laioutr Cloud](https://academy.laioutr.com/en/leitfaeden/laioutr-cloud)
- [Password-protect the storefront until launch](https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch)
# Password-protect the storefront until launch
Laioutr Cloud password protection puts a password page in front of individual storefront hostnames. Previews are protected by default, production and custom domains are switched on one by one, and bypass secrets let tests and Studio through.
## Before you start
- Plan
- Laioutr Cloud
- Role
- Owner or Project Manager
- Duration
- 5 min
### Prerequisites
- The storefront's hostnames, for example www domains
Last reviewed on October 15, 2026
Until launch, a storefront often should be visible only to the project team. **Password protection** puts a password page in front of a hostname for that. The check runs at the edge, before a request reaches the storefront or its cache.
- **Previews** are protected by default: every deployment's own address and all environments other than production.
- **The production hostname and custom domains** are switched on one by one.
- **Apex domains** without www cannot be protected; they redirect to www.
A project has one password. A new password replaces the old one and logs everyone out; visitors who entered the password stay logged in for seven days. For machines such as CI tests or monitoring there are **bypass secrets**, one per machine, up to 20 per project. Studio has its own secret, which Cockpit creates automatically, so protected previews stay visible in the editor.
If a protected hostname cannot be checked, it answers 503 and never serves the page unprotected.
## Step by step
1. 1 ### Step 1: Open the panel Open **Hosting › Laioutr Cloud** in Cockpit and go to **Password protection**.
2. 2 ### Step 2: Set the password Set a password for the project and share it with the team.
3. 3 ### Step 3: Protect hostnames Switch protection on for the production hostname and each custom domain one by one, always using the www variant for domains.
4. 4 ### Step 4: Follow the warnings If Cockpit names a hostname that serves the same storefront publicly, protect that one as well.
5. 5 ### Step 5: Create bypass secrets Create a separate secret for each machine, such as a CI test or a monitoring check. It is sent in the `x-laioutr-protection-bypass` header.
6. 6 ### Step 6: Switch off at launch On launch day, switch protection off for production and the domains. The change takes effect within 60 seconds.
## Check the result
A private browser window shows the password page on the protected hostname, and the storefront appears after the password is entered. Studio still shows protected previews in Chrome, Edge or Firefox.
## Frequently asked questions
Why does Studio show the password page in Safari?
Safari blocks cookies inside cross-site frames, so the cookie set by the Studio secret never reaches the preview. Use Studio in Chrome, Edge or Firefox, or switch protection off for that hostname while editing.
What happens after too many failed attempts?
From ten attempts per minute per IP address and hostname, the page answers 429 and asks to wait until the minute ends.
How is a bypass secret revoked?
Revoke it in the same panel; it stops working within 60 seconds. The Studio secret cannot be revoked, only rotated.
Can tests run without a header?
Yes. The secret can also be sent as the query parameter `x-laioutr-protection-bypass`, or set as a cookie with the parameter `x-laioutr-set-bypass-cookie=true`.
## Related
- [Connect a custom domain](https://academy.laioutr.com/en/artikel/connect-a-custom-domain)6 min
A custom domain is assigned to a market in Cockpit and linked to a language. After the DNS record is set at the domain provider and a deployment has run, Laioutr Cloud serves the storefront under that domain.
- [Go-live checklist](https://academy.laioutr.com/en/artikel/go-live-checklist)10 min
Before going live, five areas are checked: account, project, markets and languages; the tested app connection; published pages including legal pages; SEO basics and redirects; and finally deployment, custom domain and removing password protection.
- [Compare and roll back deployments](https://academy.laioutr.com/en/artikel/compare-and-roll-back-deployments)5 min
Every deployment has its own address, so two versions can be compared side by side. A rollback puts an already built earlier production deployment live again within seconds, without a new build.
- [Preview and publish changes in Studio](https://academy.laioutr.com/en/artikel/preview-and-publish-changes-in-studio)5 min
Studio saves changes as a draft and shows them instantly in the live preview. Publish in the top bar takes the saved state to the storefront through a deployment of the environment.
## Learn it in a lesson
- [Apply the go-live checklist](https://academy.laioutr.com/en/lektionen/frontend-manager-go-live-checklist)8 min
- [Password protection until launch](https://academy.laioutr.com/en/lektionen/go-live-password-protection)4 min
## [Laioutr Cloud](https://academy.laioutr.com/en/leitfaeden/laioutr-cloud)
Search this guide
1. [Hosting and edge delivery](https://academy.laioutr.com/en/artikel/hosting-and-edge-delivery)4 min
2. [Connect a custom domain](https://academy.laioutr.com/en/artikel/connect-a-custom-domain)6 min
3. [Password-protect the storefront until launch](https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch)5 min
4. [Deliver images through the Laioutr CDN](https://academy.laioutr.com/en/artikel/deliver-images-through-the-laioutr-cdn)4 min
5. [Deliver videos through the Video CDN](https://academy.laioutr.com/en/artikel/deliver-videos-through-the-video-cdn)6 min
6. [Protect forms from bots and spam](https://academy.laioutr.com/en/artikel/protect-forms-from-bots-and-spam)7 min
7. [Deliver the storefront as a progressive web app](https://academy.laioutr.com/en/artikel/deliver-the-storefront-as-a-progressive-web-app)5 min
## Structured Data
```json
{
"@context": "https://schema.org",
"@graph": [
{
"@id": "https://academy.laioutr.com/#website",
"@type": "WebSite",
"inLanguage": "en",
"name": "Default",
"url": "https://academy.laioutr.com/",
"translationOfWork": {
"@id": "https://academy.laioutr.com/#website"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#webpage",
"name": "Academy Article",
"url": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch",
"@type": [
"WebPage",
"FAQPage"
],
"breadcrumb": {
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#breadcrumb"
},
"isPartOf": {
"@id": "https://academy.laioutr.com/#website"
},
"mainEntity": [
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#/schema/question/1"
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#/schema/question/2"
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#/schema/question/3"
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#/schema/question/4"
}
],
"potentialAction": [
{
"@type": "ReadAction",
"target": [
"https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch"
]
}
]
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#breadcrumb",
"@type": "BreadcrumbList",
"itemListElement": [
{
"@type": "ListItem",
"name": "Home",
"item": "https://academy.laioutr.com/en",
"position": 1
},
{
"@type": "ListItem",
"name": "Hosting and operations",
"item": "https://academy.laioutr.com/en/bereiche/hosting-and-operations",
"position": 2
},
{
"@type": "ListItem",
"name": "Laioutr Cloud",
"item": "https://academy.laioutr.com/en/leitfaeden/laioutr-cloud",
"position": 3
},
{
"@type": "ListItem",
"name": "Password-protect the storefront until launch",
"item": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch",
"position": 4
}
]
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#/schema/question/1",
"@type": "Question",
"inLanguage": "en",
"name": "Why does Studio show the password page in Safari?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Safari blocks cookies inside cross-site frames, so the cookie set by the Studio secret never reaches the preview. Use Studio in Chrome, Edge or Firefox, or switch protection off for that hostname while editing.
"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#/schema/question/2",
"@type": "Question",
"inLanguage": "en",
"name": "What happens after too many failed attempts?",
"acceptedAnswer": {
"@type": "Answer",
"text": "From ten attempts per minute per IP address and hostname, the page answers 429 and asks to wait until the minute ends.
"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#/schema/question/3",
"@type": "Question",
"inLanguage": "en",
"name": "How is a bypass secret revoked?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Revoke it in the same panel; it stops working within 60 seconds. The Studio secret cannot be revoked, only rotated.
"
}
},
{
"@id": "https://academy.laioutr.com/en/artikel/password-protect-the-storefront-until-launch#/schema/question/4",
"@type": "Question",
"inLanguage": "en",
"name": "Can tests run without a header?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Yes. The secret can also be sent as the query parameter x-laioutr-protection-bypass, or set as a cookie with the parameter x-laioutr-set-bypass-cookie=true.
"
}
}
]
}
```