Not Every Page Should Be Public. Locking One Down Shouldn't Take a Plugin.

Not Every Page Should Be Public. Locking One Down Shouldn't Take a Plugin.

Not every page on a website is supposed to be public. A florist runs a wholesale price list for other shops. A photographer sends a private gallery so a couple can pick their favorites before the album goes to print. A contractor keeps a page with project files for one specific client, not for anyone who finds the link on Google. All real. None of them belong on the open internet.

Most people solve this by way overbuilding it. They sign up for a client-portal app that costs twenty or thirty bucks a month to do one job: hide a page from strangers. Or they're on WordPress, where the built-in password option is thin. It locks a single page, sure, but it doesn't play well with most page builders and it's really meant for something temporary and low-stakes, not a page you actually depend on. So people bolt on a plugin, and now there's another piece of software to keep updated on a site that was already a maintenance headache.

A password on a page is a light switch. It shouldn't require rewiring the house.

Cantrip builds it into page settings. Open the page, flip on password protection, set a password, save it. Visitors who load that page get a plain password prompt. Type it in once and it holds for the rest of the visit, so nobody's re-entering a password every time they click a link. The password itself is hashed on our end, so it's never sitting around exposed to the browser or anyone poking at the page source.

Worth being straight about what this is and isn't. It's one shared password for one page, not individual logins where each client sees their own content. If you're running a business where fifty clients each need their own private dashboard, that's a real product category and it's not this. But that's a rarer need than people think. Most of the time what someone actually wants is simpler: keep this one page off Google, off the nav menu, out of casual view, and only reachable by whoever has the password. That's the whole job, and a shared password does it.

The bigger pattern here is one we run into constantly. Somebody needs a small thing done and reaches for a subscription or a plugin ecosystem built for a much bigger problem. Most of the time the small thing was already sitting in settings the whole time.