# Lockdown a website, password protect

**URL:** <https://www.ruby-forum.com/t/lockdown-a-website-password-protect/226483>\
**Category:** NGINX\
**Created:** [December 9, 2012, 3:49am UTC](https://www.ruby-forum.com/t/lockdown-a-website-password-protect/226483 "2012-12-09T03:49:42Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![S\_Ahmed](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8c91f0/32.png) [@S\_Ahmed](https://www.ruby-forum.com/u/S_Ahmed)\
**Post date:** [December 9, 2012, 3:49am UTC](https://www.ruby-forum.com/t/lockdown-a-website-password-protect/226483/1 "2012-12-09T03:49:42Z")

</div>

Before I launch my website, I want to be able to test it live in  
production  
but don’t want anyone else to view it.

Would it be possible to lock down the website except for the main page,  
all  
other pages require me to enter a password to view it?

I can do this many ways (by limited ip address etc), but I was wondering  
if  
there was a simple way to do it via nginx somehow which would save me  
the  
work.

I’ve seen some very crude types of authentication where you get this  
ugly  
popup and you enter the password and you can view the site.

I believe it was using the web server to do this.

Possible?

---

<div class="post-metadata">

**Author:** ![S\_Ahmed](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/s/8c91f0/32.png) [@S\_Ahmed](https://www.ruby-forum.com/u/S_Ahmed)\
**Post date:** [December 9, 2012, 12:04pm UTC](https://www.ruby-forum.com/t/lockdown-a-website-password-protect/226483/2 "2012-12-09T12:04:57Z")

</div>

On Sat, Dec 08, 2012 at 09:48:54PM -0500, S Ahmed wrote:

Hi there,

> Before I launch my website, I want to be able to test it live in production  
> but don’t want anyone else to view it.

The most straightforward way is probably to use a separate server{}  
block  
for “now” and “next”, and protect all of “next” and none of “now”. Then,  
when you’re happy with it, remove the protection and swap names.

If you don’t want to do that…

> Would it be possible to lock down the website except for the main page, all  
> other pages require me to enter a password to view it?

Yes.

Provided that you can specify which locations correspond to “the main  
page” and which do not.

Put access control – for example “auth\_basic”  
([Module ngx\_http\_auth\_basic\_module](http://nginx.org/r/auth_basic)) and associated directives – at server{}  
level, then in “the main page” locations, remove it – for example, by  
“auth\_basic off”.

“the main page” is probably some combination of things like

location = / {}  
location = /index.html {}  
location = /images/banner.png {}

and maybe more.

## f

Francis D. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)