Password Protection and Domain Allowlists
Restrict a tour with a password or a domain allow-list, and decide when private access is the right choice for your content.
You will protect a tour with a password, with a domain allow-list or with both, and you will learn how a private tour behaves for a visitor who has the link but not the key.
Set a password
Switch the visibility of the tour to Private and set a password. The viewer loads a small form before the panorama appears, and the password is checked by the platform, not by the page that hosts the embed. Visitors can still forward the password if you publish it.
- Open the share dialog and change the visibility to Private.
- Set the password and confirm it a second time.
- Publish the change so the live tour picks it up.
- Test the tour in a private window without entering the password.
Use a domain allow-list
A domain allow-list restricts the tour to pages served from the domains you name. Add each domain in the form example.com, without a path. Visitors who arrive from any other origin, including a link shared in a chat, are refused.
Password protection and an allow-list can be combined. Use both when a tour must stay inside a client portal and still has to be reviewed by a small group.
Plan the exit
Private tours are invisible in listings and in search results, so plan how people find them. Put the link behind a login, send it by e-mail, or print it as a QR code with the password on the next line of the page.