What are the options to share unfinished web-page with a customer without allowing third-party to see the work in progress when developer has control over the web-server? I could come up with following:

  1. Configure web-server to listen on some random port. For example, this means that web-site is accessible from http://www.example.com:48080. However, one is able to detect the web server easily with port scan and access the web-site.
  2. Make the content available only if it is prefixed with a unique string. However, this does not protect against fuzzers. Example using Apache mod_rewrite:
        # Web-page is available from https://example.com/5d15d58b294ee/index.html
        # while https://example.com/index.html sends HTTP status code 403(forbidden).
        # Probably easier approach would be to move all the web-page files to directory named 5d15d58b294ee.
        RewriteRule "^/5d15d58b294ee/(.*)" "/$1" [L]
        RewriteRule "^/.*" - [F,L]
  1. Use authentication. For example, Apache basic authentication.

Out of those three options, the third one seems to be the most secure. However, the second one is probably more convenient and maybe usually secure enough.

  • 3
    If by "fuzzers" you mean a brute force attack to crack your unique string - that seems v.unlikely to me. All three methods are OK IMO. It's a compromise between ease of use/implementation and security. But how secure does this need to be? You would still send an X-Robots-Tag: noindex,nofollow header whatever method you choose. If you did need secuirty as your title suggests, then authentication is the only way.
    – DocRoot
    Jun 28, 2019 at 11:25
  • This question is Unclear and Too Broad. It's not clear what resources you need to secure (for example, whether there's any data persistence that you need to separate) or who should access them or what resources you have at your disposal to do so. Is a separate machine limited to VPN an option? Does the site have log in credentials that you could issue test credentials for? There's just too many unanswered questions about what your requirements are. "Secure" is never sufficient; you always have to answer the question of, "Secure from what?"
    – jpmc26
    Jun 28, 2019 at 20:23
  • I will say that no matter what, you should deploy a completely separate copy of the web site and any data persistent resources behind it for demo purposes. Segregating the demo from prod as much as possible will go a long way toward preventing any accidental or malicious damage to production, and the more separate it is the better (separate machines would be the ideal).
    – jpmc26
    Jun 28, 2019 at 20:25

4 Answers 4


If you know your customer IP Address, the safer way to share unfinished web-page is to deny access to everyone but you and it in a .htaccess file at the root of your working directory.

order deny,allow
deny from all
allow from xx.xxx.xx.xx #your ip address here
allow from xx.xxx.xx.xx #your customer ip address here

ErrorDocument 403 http://example.com #the web page you potentially want intruders to be redirected to

Side Note:

Just remember that if a customer is using a VPN, or has a dynamic IP address, you will need to keep modifying the IP entry in the .htaccess file as to reflect their latest IP address. A similar situation may arise, in the event that the customer turns off their router then back on again.

As such, it may be wise to let the customer know in advance to contact you if they cannot access the website from time to time. Obviously, explaining the cause of the loss of access rather than letting them assume there may be an issue with the website. Failure to inform the customer in advance, may result in a loss of confidence.

  • "intruders to be redirected to" - You shouldn't be "redirecting" users to the error document, which is what will happen here if you specify an absolute URL in the ErrorDocument directive. The user / bot sees a 302 response instead of a 403 (unless you explicitly send a 403 response in your error document - but that's a second (unnecessary) request) and potentially indexes your error document!
    – DocRoot
    Jul 1, 2019 at 23:16

Here are some answers, in order:

  1. There exist only 65,535 ports, so this is a very small space to hide in, relatively speaking. Someone could enumerate your ports without much effort, so this solution is a no-go.

  2. Using a key as part of the URL is a much better idea. There exist more than 200 trillion 13-character alphanumeric strings, so the probability of someone guessing it with a fuzzer is essentially zero. The only concern is that since the key is part of the URL, the key will become part of the user's browsing history and the history of any caching proxies (or maybe even a search engine if the URL gets leaked). This is probably not any security issue, but something to keep in mind.

  3. This is the best idea if it's convenient enough.

So (3) is technically the most secure, but if you're just sharing a client site and not incredibly sensitive data, (2) should be more than good enough. If I were to go with (2), I would also serve up the X-Robots-Tag: noindex header to give it a better chance of not being picked up by search engines if the URL leaks, but that might be overkill.


If you're only showing the design and interactivity is not required, you can simply send a screenshot

  • 1
    Such a short answer is not high quality. Can you expand your answer? Perhaps give a possible solution for when interactivity is required as well? Jun 28, 2019 at 20:52

To do what you are asking for, I use a little tool called 'ngrok'. It exposes a local server behind NAT's and firewall's to the public internet over secure tunnels. For more info you can visit the official website at ngrok official website

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.