Access modes
A site is public unless you say otherwise. Two protected modes exist, and both put an authentication layer in front of every page at the edge rather than relying on anything in the page itself.
One thing the create wizard says is not true, and it is worth knowing before you plan around it.
#The three modes
Mode | What a visitor does | Good for |
|---|---|---|
Public | Nothing. The site is open | Documentation, marketing, anything you want indexed |
Password protected | Enters one shared password, at least 8 characters | A partner portal, a private preview |
Login with Atlassian | Signs in with an Atlassian account, optionally restricted to allowed email domains | An internal site for your own people |
Both protected modes take a session duration, so you decide how often people re-authenticate.
#Confluence restrictions do not carry over
Page restrictions in Confluence are not access control on a published site. If a page is in a space you published, it is on the site. Use the exclude label, or do not publish that space.
#Signing out
There is no sign-out link on a published protected site. The endpoint exists, but no page links to it, so it can only be reached by typing the address.
#A few things worth knowing
Staging previews are shareable by link. On a protected site the preview is protected too; treat the link as sensitive.
A password is one shared secret for the whole site. There are no per-visitor accounts.
Allowed email domains only apply to the Atlassian login mode.
#Related
Public by default. Restrictions do not carry over.
