How do I protect a tour with a password?
Make a tour private, set a password, restrict it to a domain allow-list and keep the shared link safe for clients.
Privacy is set when you publish. A private tour asks for a password before the player appears, and an allow-list can restrict the embed to your own domains only.
Set the password
- Open Project → Publish and switch to the Visibility section.
- Choose Private and turn on Password protection.
- Enter the password, confirm it and publish the tour again.
The password is checked in the browser before the player starts, so a visitor without it never downloads the panorama files. Publish a new version to change the password: the old one keeps working until the new version is live, which is useful when you send the link out before the tour is ready. For a tour that is not announced yet, the unlisted mode is the safer default. A lost password cannot be recovered from the link: remove the protection and publish a new version, then send the updated link to the client. The unlisted mode keeps the link working without showing the tour in public listings and search results, so it is a good middle step between a public tour and a password-protected one. Protection is removed in the same publish dialog: untick the password box and publish a new version.
Restrict the embed
In the same dialog, add the domains that may host the iframe, for example yoursite.com and www.yoursite.com. Requests from any other origin are refused, which stops other sites from copying your tour.
Share it safely
- Send the password in a separate message from the link.
- Change the password by publishing a new version with a new one.
- Clients who have the link but not the password see a password screen.
Password protection is not encryption. The panorama files are still delivered to the browser, so do not use it to hide confidential plans or unfinished work.
Still need help?
Can't find what you're looking for? Our support team is here to help.