Skip to main content
Password protection is available as a Communicate Team add-on. View pricing
Password protection makes your status page private. Visitors must enter a password before they can view service health, uptime data, or incidents. This is useful when your status page contains sensitive operational information intended for internal teams or select customers.

​
Enabling password protection

  1. Open your status page from the Status Pages overview.
  2. In the status page settings, enable the Private toggle.
  3. A password is automatically generated. Copy it and store it somewhere safe — it is only displayed once.
  4. Save your status page.
Your status page now requires a password to access. Share the password with the people who need access.
The password is only shown once when it is generated. If you lose it, you will need to regenerate a new one.

​
How visitors access a private status page

When someone visits a password-protected status page, they see a login form. After entering the correct password, they are authenticated for 30 days before needing to enter it again.
If your status page uses both a subdomain (your-page.checkly-status-page.com) and a custom domain, visitors need to log in separately on each domain. Authentication does not carry over between domains.

​
Rotating the password

You can regenerate the password at any time from the status page settings. When you do:
  • A new password is generated and displayed once — store it somewhere safe.
  • All existing sessions are invalidated. Every viewer will need to re-authenticate with the new password.
Use password rotation when someone who had access no longer should, or as a routine security practice.

​
Disabling password protection

To make your status page public again, turn off the Private toggle in your status page settings and save. The password is deleted and anyone can view the page without authentication.

​
Good to know

  • Search engines: Private status pages are excluded from search engine indexing. They use noindex, nofollow directives, so your operational data won’t appear in search results.
  • Rate limiting: Password entry is rate-limited to 5 attempts per minute per IP address to protect against brute-force attacks.