# Passcodes and members-only

Keep a whole site or one section private. A passcode is the quickest: anyone with the code gets in. Members-only lets in only the people you name, after they sign in with their email.

## Say this to your AI

```prompt
Protect this site with a passcode
```

Or only one section:

```prompt
Put a passcode on the /lessons page
```

## What happens

1. Your AI gives you a private Page Lemon link. It works once, for 15 minutes.
2. Open it and type your passcode there: 6 digits, or a longer password of 8 characters or more. The passcode never goes through the chat.
3. Visitors see a page asking for the passcode. Once they type it, that browser stays unlocked for 30 days.

You can also tell your AI the passcode in the chat if you prefer. Either way, Page Lemon stores only a scrambled form of it (a one-way hash), so it can't show it to you again: note it down.

> **Plans:** a passcode works on every plan, Free included, once the site is kept in your account. Members-only needs a paid plan; on Free, your AI can offer a 14-day free trial with no card, and asks before starting it.

## Members-only

```prompt
Make my site members-only and let in alex@example.com and claire@example.com
```

1. You approve the people once, in your browser.
2. Each person is emailed an invite. They sign in with that email address and can then open the site.
3. Everyone else sees a sign-in page. Removing someone signs them out at once.

- Let in a whole company by its domain, like `acme.com` (not gmail.com or other free email providers).
- Make one section members-only and leave the rest public (Builder and up): "Show /investors only to the people I add."
- Members-only replaces a site passcode, so remove the passcode first.
- How many people you can let in, across all your sites: 25 on Prompter, 100 on Builder, 250 on Team, 500 on Company.

## Change or remove protection

- **Change the passcode:** ask for a new one. Everyone who unlocked the site with the old one is signed out.
- **Open the site again:** "Make my site public again". You approve it once in your browser.
- **See what's protected:** ask "Who can see my site?", or open the site → **Access** in your account.

## Good to know

- Locked sections per site: up to 3 on Builder and up to 10 on Team. They share one protection, the same passcode or the same email list. Adding a section reuses it, and changing it changes all of them. Company gets up to 10, each with its own passcode or email list. The most specific one wins, and whole-site protection still applies.
- Emails on locked sections count in the same members-only visitors total as people let into a whole site.
- If your plan ends (a downgrade, a failed payment, a cancellation or an ended trial), you get 14 days with everything working, with emails at the start and 3 days before the end. After that, locked sections over your plan, and whole-site members-only on a plan without it, go offline: visitors see "not available right now". They are never made public. Forms and bookings stop taking new ones (what you have is kept, and customers can still cancel bookings). Custom domains over your plan send visitors to the site's pagelemon.dev address, and extra sites freeze, oldest first. Nothing is deleted, and upgrading brings everything back.
- Before a downgrade you start yourself, you see what changes and choose "lock the whole site instead" or "take those pages offline".
- After 10 wrong tries in 15 minutes, a visitor has to wait before trying again.
- Search engines don't see locked pages: they get the passcode page, marked not to be indexed.
- When you protect a site, copies held by our network are cleared, so the old public pages stop showing.