Password-Protected Link
A password-protected link is a URL that shows a password prompt before it sends a visitor to its destination. Only people who enter the correct password reach the page or file behind it. It is used to share gated content, client previews, and internal files without making them public.
How a Password-Protected Link Works
The password check happens on the server that owns the link, before any redirect. Most password-protected links are short links run by a link management tool or a file-sharing service.
- A visitor clicks or scans the link.
- The server sees a password rule on that link and returns a password page instead of redirecting.
- The visitor submits the password. The server compares it with the stored value (ideally a salted hash, as the OWASP Password Storage Cheat Sheet recommends).
- If it matches, the server sends a 302 redirect to the destination URL. If not, the prompt shows again.
The exchange for a correct password looks like this:
POST /q3-report HTTP/1.1
Host: go.example.com
Content-Type: application/x-www-form-urlencoded
password=Harbor-2026
HTTP/1.1 302 Found
Location: https://drive.example.com/files/q3-board-report.pdf
The password travels in the request body. That is why the link must run over HTTPS. Without it, anyone on the same network can read the password in transit.
Password-Protected Link vs Private Link vs Expiring Link
These three terms often get mixed up. Each one controls a different thing.
| Type | What controls access | Who can open it | Stops working when |
|---|---|---|---|
| Password-protected link | A shared secret | Anyone with the link and the password | You remove or change the password |
| Private (unlisted) link | Nobody knows the URL | Anyone who has the URL | You delete or reset the link |
| Expiring link | A date, time, or click count | Anyone with the link, until the cutoff | The rule triggers |
A private link relies only on obscurity. YouTube “unlisted” videos and Google Drive “anyone with the link” shares work this way. Once the URL is forwarded, it is effectively public.
A secure link is a general term, not a feature. It usually means HTTPS plus at least one access control, such as a password or link expiration. The strongest setups combine a password with an expiry date, so a leaked password stops working too.
Common Uses
- Client previews. Agencies share staging sites or draft creative before launch.
- Gated content. A webinar recording or report goes only to registered attendees.
- Internal documents. Pricing sheets and board decks shared across teams.
- Exclusive offers. A members-only discount where the password is the access code.
- File shares. Dropbox lets Professional and team accounts add a password to a shared link.
Limits of Password-Protected Links
A password-protected link protects the link, not the destination. This is the most common misconception.
- The destination URL is exposed after unlocking. After the redirect, the real URL sits in the address bar. A visitor can copy it and share it, skipping the password entirely. If the destination itself must stay private, it needs its own login.
- Shared passwords spread. One password for 200 people works like a public link once it is posted in a group chat. Rotate it after each campaign.
- No identity. A password proves knowledge, not who the visitor is. For per-person access, use accounts or single sign-on.
- Basic Auth is weaker than it looks. HTTP Basic authentication (RFC 7617) sends credentials in cleartext. The RFC warns it should not be used without enhancements such as HTTPS.
Search engines cannot get past a password prompt. Google Search Central recommends password protection as a reliable way to keep a page out of search results.
How to Password Protect a Link
Pick the method that matches what you are sharing:
- A web page on WordPress: set the post visibility to “Password protected” in the editor.
- A file: use the share settings in Dropbox, OneDrive, or a similar service, if your plan supports it.
- Any URL: wrap it in a short link and add a password rule. With linkutm’s link protection, you add a password, expiry date, or click limit in the link’s Protection settings, plus a fallback URL for blocked visitors.
Frequently Asked Questions
What is a password protected URL?
A password protected URL is a web address that requires a password before showing its content. “Password protected URL” and “password-protected link” mean the same thing. The check runs either on the link (a redirect gate) or on the page itself (a login or Basic Auth). The difference matters: a link-level gate does not protect the destination if someone finds its direct address.
Is a password-protected link secure?
A password-protected link is secure enough for low and medium-risk sharing, such as previews and gated marketing content. It is not a substitute for real access control on sensitive data. Use HTTPS, a strong unique password, and an expiry date. For confidential files, use a service where the file itself requires sign-in.
Can Google index a password-protected link?
No. Googlebot cannot submit a password, so it never sees the content behind the prompt. Google Search Central lists password protection as one of the recommended ways to keep a page out of Google. The destination can still be indexed if it is publicly reachable and linked from elsewhere.
What is the difference between a private link and a password-protected link?
A private link hides content by keeping the URL secret. A password-protected link adds a second secret: the password. Anyone who gets a private link can open it, while a password-protected link also needs the password. That extra step is why a password-protected link survives being forwarded and a private link does not.
Can you change the password on a link after sharing it?
Yes, on most link management tools. The URL stays the same, and only people with the new password can open it. Changing the password is the quickest way to cut off access after a link has spread beyond its audience.
To add a password, expiry date, or click limit to any branded short link, see linkutm’s link protection features.