Overview
Most sites in review are not finished, and unfinished sites are usually locked in some way — a staging password, an .htaccess prompt, or a coming soon page. Huddlekit handles most of these. Which method you use depends on how the site is locked.
If the site sits behind a user account rather than a site-wide password — a dashboard, an LMS, a member area — none of the methods below apply. Use a Web App project instead, which installs a small widget inside your own site.
HTTP basic auth (.htaccess / htpasswd)
If the site prompts for a username and password in a browser dialog, put the credentials directly in the project URL when you create the project:
https://username:password@staging.example.com
Huddlekit uses them for every request to that site, including the pages you navigate to afterwards. Digest authentication works the same way.
Credentials added this way become part of the project URL. Anyone with access to the project can see it, including guests on a share link and anyone using a workspace API key, and it's included in the links Huddlekit sends to connected tools like Slack, Linear, ClickUp, Notion and Asana, to AI tools over MCP, and in notification emails. Treat them as shared with your reviewers, and use a throwaway staging password rather than one that protects anything else.
Site passwords on hosting platforms
For platforms that show their own password page rather than a browser dialog, just enter the password on that page inside the Huddlekit review view. Huddlekit remembers it for that site so you are not asked again on every page.
| Platform | Works |
|---|---|
| Netlify password protection | Yes |
| Vercel Deployment Protection (password) | Yes |
| Webflow site and page passwords | Yes |
| Squarespace site-wide and page passwords | Yes |
| WordPress password-protected pages and posts | Yes |
| Shopify storefront password | Yes |
| Wix password-protected pages | No |
For Wix, remove the password for the duration of the review, or set the project up as a Web App project instead.
On Shopify, entering the password always lands you on the homepage, which is Shopify's own behaviour. Navigate to the page you want from there.
Coming soon and maintenance pages
A coming soon plugin answers every request with a splash page, so without help Huddlekit would load the splash page and let people pin comments to it. Huddlekit detects the common plugins — LightStart, SeedProd, Minimal Coming Soon, and Elementor's maintenance mode — and tells you the site is gated instead of showing you the wrong page.
For most of these plugins there are two ways through it. Elementor's maintenance mode and Minimal Coming Soon are the exceptions: they only let logged-in WordPress users through, so neither route below works for them. For those, switch to a coming soon plugin that offers a bypass link, or protect the site with a site-wide password instead.
Use the plugin's bypass link
Most coming soon plugins can issue a secret URL that skips the splash page. Paste that whole URL, including its token, as the project URL. Huddlekit carries the token onto the links inside the site, so reviewers can navigate normally without hitting the gate again. Like basic auth credentials, the token becomes part of the project URL and is visible to the same people.
This is the quickest route and needs no changes in Huddlekit. Check your plugin's settings for a "bypass", "secret link", or "exclude" option — note that some plugins only offer this on their paid tier.
Allow Huddlekit's address
If your plugin only supports an IP allowlist, Huddlekit can reach your site from a single fixed address. Email support@huddlekit.com and we will send you the current address to add to your allowlist. You only do this once per site, and reviewers need to do nothing.
This address is shared by every Huddlekit workspace, so allowlisting it lets anyone who creates a Huddlekit project for your site past the gate. For content that has to stay private until launch, use a bypass link or a site password instead.
Hosts that block automated traffic
Some hosts' security checks turn away requests that don't come from a person's own browser, and answer with a security check or an error instead of the page. Huddlekit retries these automatically.
If a site still will not load after a retry, ask whoever manages it to allow traffic from Huddlekit. Email support@huddlekit.com and we will send you the address to give them.
Project thumbnails on locked sites
The preview image on a project card is generated separately, by loading the project URL on its own rather than through the review view. On a locked site that image can show the password page or the coming soon splash instead of the site, or fail to generate at all. It has no effect on the review itself — open the project and everything works as described above.
Still stuck?
See Website project limitations for the other reasons a site may not load, or email support@huddlekit.com with the project URL and we will take a look.