Skip to main content
Working on something the public shouldn’t see yet? Holding patient, client or staff data on a test copy of your site? Private mode closes one environment to everyone except the networks you list and the people who know a password you set. Everyone else sees a plain “This site is private” page, and search engines can’t read it. Each environment is private on its own, so you can close Development and Staging and leave Production public.

​
Before you start

Have these ready:
  • The address of your office or VPN. You can add the network you’re on with one click, so open the page from each place you work.
  • Any paths other services send data to, such as your payment webhook. Private mode stops those too unless you list them. Check your payment or form provider’s settings for the exact path.

​
Open Private environment

Open the website, click its name at the top of the page, then Hosting. Click the environment to close, such as Development, then scroll to Firewall and find Private environment.

​
Choose who can open it

Turn on Only my office or VPN can open this environment. Then add at least one way in.
1

Add your networks

Click Add the network I’m on now. To add another, type its address or range and what it is, then click Add. If your network also connects with a newer (IPv6) address, add that too, or people on that network will be turned away.
2

Set a password, if you want one

A password lets people in from anywhere, which suits a reviewer at home. Use at least 12 characters. Visitors type it on the private page, and their browser remembers it for 30 days. It’s never shown again after you save.
3

Add the paths other services call

Under Paths other services call, add each path exactly as the service calls it, such as /api/stripe/webhook. If the service is in the list, choose it as the only sender for that path.
An open path is for a route another service sends data to, never a page. Anyone can post to it, so a path that leads to a page of your site is refused, and so is a publish that would put a page under one. Each entry opens exactly that path and nothing under it.

​
Turn it on

Click Make it private, read the summary, then click Make it private again. Within a few minutes, everyone not on your list sees the private page. Hiveku then locks the environment’s server, so nobody can reach the site around private mode. That takes about 15 minutes. Server lock shows the progress and reads Locked when it’s done. Until then, the server’s own address still answers.

​
Change it, or make it public again

Come back to Private environment any time to change the list, or turn the switch off to make the environment public again. Anyone with its address can open it again within a few minutes. Locked yourself out? This page always works, because it isn’t private. Open it from where you are, choose Add the network I’m on now, and save.

​
Good to know

  • Live Preview. It opens only for people signed in to Hiveku with access to the site.
  • Your team’s review canvas. Team members can still review a private environment. Review links don’t open one, so add reviewers to your team instead.
  • Publishing. Publish as usual. Hiveku’s check of each new version still runs, and the lock stays on.
  • Going back to an older version. Versions published before the environment was private can’t be served again, because that would open its server’s address. Choose a newer one.
  • Files in your media library aren’t covered. Anyone with a file’s link can open it. Keep private documents in the site’s own files.
  • Other services that read your pages, such as workflows and phone apps, get the private page. Only requests that send data to a path you opened get through.
  • Your site’s own calls. Your site’s server can call its own address from its pages and routes. Calls it makes while starting, from middleware or during a build get the private page.
  • Uptime. The monitor can’t see inside a private environment, so it reports it as private, never as down.
  • Scripts on your site can read the password’s cookie in a visitor’s browser, so only add scripts you trust.
  • Keep your own sign-in on. Your listed networks open the site without a sign-in. If it holds staff or member data, keep its own sign-in on too.