Information checked: 21 July 2026.
A single shared password can be suitable for low-risk temporary material, but it is not a substitute for individual accounts where access must be revoked, audited or separated between clients.
In brief: Use shared passwords only for genuinely low-risk temporary access; use named accounts and tested authorisation when access matters.
Choose the protection level
Access-control choices
- Temporary low-risk event document
- Suitable starting point: Time-limited shared password; Why: Simple where individual accountability is unnecessary
- Client-specific files
- Suitable starting point: Individual accounts with per-client permissions; Why: Prevents one client seeing another client’s data
- Staff resources
- Suitable starting point: Named users and roles; Why: Supports offboarding and audit
- Paid content
- Suitable starting point: Membership accounts linked to entitlement; Why: Handles expiry, cancellation and support
- Highly sensitive records
- Suitable starting point: Specialist secure service; Why: Ordinary website protection may be inadequate
Do not rely on hidden URLs
A page excluded from navigation can still be discovered through links, logs, search engines or guessing. Real protection requires server-side authorisation before content is returned.
Manage credentials safely
Use individual identities where practical, MFA for privileged access, rate limiting and secure password reset. Never email existing passwords in plain text or let administrators view them. Record who owns emergency recovery.
Prevent accidental indexing and caching
Protected responses should not leak through search indexes, public sitemaps, CDN caches, previews or file URLs. Test the page in a signed-out browser and request protected files directly.
Acceptance test
Create two users with different permissions, revoke one, reset a password, test repeated failed login and verify direct file access. Review logs and confirm the business can recover administration without the original developer.
Example: protected page, public file
A page asks for a password but links to a PDF stored at a public predictable URL. Anyone with the link can bypass the page. Protect the asset at the server or storage layer, verify direct requests while signed out and prevent public caches from storing authorised responses.
What the business should retain
- Protected content inventory
- User and role list
- Direct-file access test
- Password-reset and MFA process
- Access-log and offboarding record
Sources and date checked
Technical and product information was checked against the following primary sources on 21 July 2026. Plans, interfaces and provider terms can change, so recheck them before purchase or migration.
Keep the decision under your control
Retain the relevant accounts, source material, supplier terms and recovery information. Recheck changing prices, interfaces and rules before acting.