Access Control
Definition
Access control answers two questions in order. Authentication asks who is making the request — a password, a sign-in, a token. Authorisation asks whether that party is allowed the thing they asked for. Full application platforms carry both, with per-person accounts, roles and a permission record for every object. Static hosting works at a coarser grain: the unit being protected is a file or a whole published address, and the gate sits in front of it rather than inside it. The controls available are therefore blunt but dependable — a password on the address, an expiry date, a restriction by country, or simply an address that is long enough not to be found. None of them know the name of the person on the other end.
Why It Matters
Most leaks are not break-ins; they are a link that was never gated at all, pasted into a thread that grew. A salary review published as a public URL is one forward away from everyone, and search engines index what they can crawl. Choosing the right gate is also a cost decision: a password on a client deck takes ten seconds and removes ninety percent of the risk, while building per-user accounts for four reviewers takes a week and a server to run it on. Be honest with yourself about which threat you are defending against, then pick the cheapest control that covers it.
How It Works
On a static host the check happens at the edge, before any bytes of the file are served. A request for a protected address gets a form or a 401 instead of the content; once the password is accepted, the edge sets a short-lived cookie or token for that browser and serves the file on subsequent requests. An expiring link works on a timestamp rather than a secret, refusing to resolve after a set moment. Geoblocking and IP rules compare the connecting address against a list before the cache is consulted. What none of this provides is a per-person permission model, so there is no way to grant Sam access and revoke Alex — revoking means changing the password or retiring the address for everyone. A robots.txt file keeps honest crawlers away but is a request, not a lock.
Real-World Example
An accountancy practice publishes a 12 MB year-end pack at fernside-yearend.99helpers.site for three directors. The address carries a password and expires on 31 October. One director forwards the link to an assistant, who is prompted for the password and stops there. When a fourth director joins in November, the practice republishes under a new address with a new password rather than trying to add a person to the old one, because the gate covers the file, not the individual.
Common Mistakes
- ✕Relying on an unguessable address as the only control — a link pasted into a public ticket or a chat log is then permanently open
- ✕Assuming a password on a page also protects the assets it loads — images and PDFs referenced by direct path can remain reachable on their own
- ✕Using robots.txt to hide a sensitive file — it is a polite instruction to crawlers and a public list of the paths you would rather nobody visited
Related Terms
Read-Only Link
A URL that lets someone view a file or page without being able to change it or the original behind it. Read-only describes what the recipient can do, not who is allowed to look.
Password-Protected Link
A hosted address that asks for a shared secret before it will show the file or site behind it. One password covers everyone who has the link; there are no individual accounts.
Expiring Link
A shareable address that stops serving its file after a set moment — a date, a number of days, or a number of downloads. The file stays stored; only the route to it closes.
Two-Factor Authentication
Requiring a second proof of identity alongside the password, so that a stolen password on its own is not enough to get in. The second proof is usually a code from an app or a key held on a device.
Geoblocking
Allowing or refusing a request based on the country it appears to come from. The country is guessed from the visitor's IP address, so the result is a good approximation rather than a fact.
Put a file online in seconds
Drop in a document, an image, a page or a whole static website and share the link — free, with no build step and no server to set up.
Host a file free →