# Protection, redirects and spend safety

Everything on this page is in **Project › Settings › Protection** and **Redirects & headers**, needs the Developer role or above, and is enforced at the edge before your code runs. Changes apply within seconds.

## Password protection

Set a password and choose what it covers:

- **Preview and deployment URLs**: production and your custom domains stay public. Every deployment's own URL and every branch preview asks for the password. Good for work in progress.
- **Everything, production too**: for private betas, staging sites and client work.

Visitors see a short password page and stay signed in for 30 days on that browser. Changing the password signs everyone out. Passwords are stored as PBKDF2 hashes.

## Share links

Create a link for a client or a tester: it opens a protected (or paused) site without the password, and can expire after 1, 7 or 30 days. The link is shown once; revoke it whenever you like. It works on production and on any preview: add `?hostedge_share=…` to the address.

## Maintenance mode

Turn it on and visitors see a "Back soon" page with your message (status 503, so search engines come back later). You can still get in with the site password or a share link.

## AI crawlers

**Block AI crawlers** refuses crawlers that collect training data, such as GPTBot, ClaudeBot, CCBot, PerplexityBot, Bytespider and Amazonbot. Search engines are not affected.

## Daily request cap

Protect your plan's allowance from a traffic spike or a scraper. Set the number of requests a project may serve per UTC day; past it, the site shows a "paused for today" page until midnight UTC and admins are told once. Raising or removing the cap brings it back. The cap is checked every few minutes, so a site can go slightly over it.

## Redirects

Rules run in order before your code:

| From        | To                                | Result                                   |
| ----------- | --------------------------------- | ---------------------------------------- |
| `/old-page` | `/new-page`                       | One page                                 |
| `/blog/*`   | `/posts/:splat`                   | `/blog/2026/hello` → `/posts/2026/hello` |
| `/docs/*`   | `https://docs.example.com/:splat` | To another site                          |

Choose 301 or 308 for permanent moves, 302 or 307 for temporary ones (307 and 308 keep the request method). The query string is kept unless the destination has its own. Up to 100 redirects.

## Response headers

Add headers to matching responses, for example `Cache-Control: public, max-age=31536000, immutable` on `/assets/*`, or `X-Robots-Tag: noindex` on `/*` for a staging site. Headers that would break responses or sessions (`Set-Cookie`, `Content-Length`, `Content-Encoding`…) cannot be set. Up to 50 headers.