# Access modes

A site is public unless you say otherwise. Two protected modes exist, and both put an authentication layer in front of every page at the edge rather than relying on anything in the page itself.

One thing the create wizard says is not true, and it is worth knowing before you plan around it.

---

## The three modes

![Site visibility settings with radio options for Public, Password protected and Login with Atlassian, with Public selected.](https://help.gocapable.com/images/19c7cb8e-0da7-408d-9175-4bc4d6edc85a.webp)

One choice applies to the whole published site, and it can be changed after the site exists.

| **Mode**             | **What a visitor does**                                                            | **Good for**                                        |
| -------------------- | ---------------------------------------------------------------------------------- | --------------------------------------------------- |
| Public               | Nothing. The site is open                                                          | Documentation, marketing, anything you want indexed |
| Password protected   | Enters one shared password, at least 8 characters                                  | A partner portal, a private preview                 |
| Login with Atlassian | Signs in with an Atlassian account, optionally restricted to allowed email domains | An internal site for your own people                |

Both protected modes take a session duration, so you decide how often people re-authenticate.

---

## Confluence restrictions do not carry over

![Access settings with Login with Atlassian selected and an allowed email domains list holding a single domain.](https://help.gocapable.com/images/55f00956-a782-4be0-a647-0147dc4eb050.webp)

When visitors sign in with an Atlassian account, the allowed email domains listed here decide who gets through.

⚠️

**Page restrictions in Confluence are not access control on a published site.** If a page is in a space you published, it is on the site. Use the exclude label, or do not publish that space.

---

## Signing out

There is no sign-out link on a published protected site. The endpoint exists, but no page links to it, so it can only be reached by typing the address.

![Access settings with Password protected selected, a new password field, and a session expires after field set to twenty four hours.](https://help.gocapable.com/images/3f6d0639-987b-458e-ab7a-68b7d25c2971.webp)

Session length sits beside the shared password, and a visitor is asked for the password again once it expires.

---

## A few things worth knowing

* Staging previews are shareable by link. On a protected site the preview is protected too; treat the link as sensitive.
* A password is one shared secret for the whole site. There are no per-visitor accounts.
* Allowed email domains only apply to the Atlassian login mode.

---

## Related

[Custom domainsWhere visitors arrive.](https://help.gocapable.com/sites/custom-domains.html)

[TroubleshootingA restricted page appearing publicly.](https://help.gocapable.com/sites/troubleshooting.html)

---

_Public by default. Restrictions do not carry over._