Locking a Site to Certain Pages
Updated Oct 15, 2026
Sometimes a site should be mostly private but have one public page, or a port should only ever show one page and nothing else. The blocked-visitor setting (called deny_fallback in the configuration) handles both. You'll find it under Advanced when editing a site.
Three things it's good for
- A mostly-private site with one public page. Everyone can see the live status page; the rest needs an allowed network.
- A port that must only ever show one page, like a guest sign-in portal that should expose
/guest/and nothing else. - A plain list of allowed pages, with no redirect at all.
The settings
- Who it applies to:
- Visitors who are turned away means people who aren't on the site's allowed networks.
- Everyone means every visitor, checked before anything else.
- Redirect page: a page on the same site to send visitors to, like
/live/. It's always reachable. It must be a page on this site, never another website. (To send people to another website, use a redirect host.) - Lock: off means visitors are only redirected when they ask for the site's front page. On means every other address they try bounces back to the redirect page.
- Allowed paths: extra pages the visitor may load as-is. This is how the redirect page gets its pictures, styles and scripts.
You need at least a redirect page or one allowed path.
What visitors see
- If the page they asked for is allowed, they get it.
- If there's no redirect page, they're turned away.
- Only normal page loads are ever redirected. Anything else is turned away.
- A visitor asking for the front page, or any page when Lock is on, is sent to the redirect page.
- Otherwise they're turned away.
"Turned away" means the Access denied page for visitors who aren't on the allowed networks, or a plain Not found page when the setting applies to everyone, which reveals nothing about what's behind it.
If the site also has a login list, people who fail the other checks see the login page instead, and that comes first.
Example: a public live page, a private admin area
A hotspot dashboard where the live caller list is public and the admin pages need the home network. Select the home network's allowed list on the site, and set:
- Who: visitors who are turned away
- Redirect page:
/live/ - Lock: on
- Allowed paths: the folders the live page needs (
/css/,/js/,/images/,/fonts/) plus the one data address it updates from
People on the home network see everything. Everyone else lands on /live/, and any other address they try bounces back.
Example: one page on one port
A guest sign-in port should show /guest/ and nothing else, to everyone. Set Who to Everyone and Allowed paths to /guest/. No redirect page. Anything under /guest/ works; anything else, like /manage, gets a plain Not found and never reaches the real service.
Getting the allowed paths right
If the redirect page shows up without styling or a widget stays empty, a path is missing. Open the page in a browser, open the developer tools Network tab, and note every address it loads. Add each folder to the allowed paths.