Site Passcode Protection

Require a shared passcode before visitors can view your Forge-hosted site. Passcode protection is ideal for staging previews and client reviews — not for securing production sites.

Available on premium hosting with Forge Server.

How it works

When enabled, visitors see a Forge-branded login page until they enter the correct passcode. After unlocking, they can browse the site normally for 7 days in the same browser.

Protection applies to the entire site.

Enable passcode protection

Add a top-level Protect directive to forgerc.txt in your project root:

Protect "your-passcode-here"

With a custom message on the login page:

Protect "your-passcode-here" "Internal staging preview — ask the team for the passcode"

Example forgerc.txt

Protect "hammer-staging-2026" "Hammer marketing site — staging only"

Location /docs
  Rewrite /docs/index.html

NotFound
  Rewrite /index.html

Protect is a site-level directive — place it at the top level of the file, not indented under a Location block.

To disable passcode protection, remove the Protect line and redeploy.

Deploy

1. Add or update Protect in forgerc.txt.
2. Commit and push to your Forge-connected branch.
3. Wait for the deploy to finish.

No dashboard setting is required.

When to use it

• Good for: staging sites, client previews on *-forge-staging.getforge.io
• Not for: production security or protecting sensitive data

The passcode is stored in plain text in your repository. Treat it as a casual gate, not a secret.

Troubleshooting

Login page never appears
• Confirm the site is on premium Forge Server hosting
• Check Protect is spelled correctly in forgerc.txt with double-quoted values
• Push and redeploy if you just added the directive

Passcode works but site does not unlock
• Allow cookies for the site domain
• Test in a normal browser window, not an embedded iframe

Removing protection
• Delete the Protect line from forgerc.txt and redeploy