Protect the website on its server
Website access is different from Astor account permissions. A shared password can protect a preview website, but a JavaScript overlay cannot protect its pages, APIs or private assets.
In Project settings → Installation → Private site access, choose the environment. Owners and admins can connect a supported server and change the access policy.
Connect before locking
- Get the server installation prompt for the selected website.
- Put its credential in server-only deployment secrets.
- Add the guard before pages, private APIs and private assets.
- Publish, then refresh the connection status in Astor.
- Choose password protection and test from a fresh browser without existing access cookies.
Static-only websites need a server or edge proxy to use this protection. Never put the credential in browser code or public environment variables.
The server prompt opens when it is created. Copy installation prompt copies the full instruction even if Read the installation prompt is closed. If copying is unavailable, Astor opens the prompt so you can select and copy it manually.
Keep this one-time prompt private. Hide prompt, switching websites or leaving the view clears it from the screen. A late copy result does not restore a cleared prompt or show a message for another website.
Verify the protected behavior
A connection handshake confirms the credential is installed; it cannot prove that every route is covered. Check direct page URLs, private APIs, assets and cached responses before relying on the lock.
Changing a password, locking again or reconnecting invalidates old website access sessions. Changing the website address requires reconnection. Each server instance caches a successful access check for at most five seconds, including when it has been running for longer. A policy change can take that long to reach an existing instance. The guard fails closed if it cannot refresh expired access state.
Existing installations need the updated server module deployed to receive guard fixes. Download it from the integration guide; the browser script does not update your server guard.
Save a policy change
Astor checks your current sign-in and project permissions before saving an access change. Signing out or losing access while a password is being saved stops that change.
If another window changes the policy, the save reports a conflict and keeps your entered password fields. Use Refresh status, review the current policy, then try again. After sign-out, sign in again before managing access.
Builder integration guide
Read the canonical server integration guide for Node/Express and Fetch examples, cache rules, failure behavior and recovery. This guide ships from the same SDK source on every platform release.
Do not use website unlock access as a replacement for project membership or permission checks inside Astor.