Which lock does what
There are four controls, and they work at different levels:
| Control | Applies to | Use it for |
|---|---|---|
| Password protection | One site | A password prompt in front of the whole tool |
| IP bypass | One site | Letting the office or VPN skip that prompt |
| IP blocking | One site | Shutting out specific addresses or ranges |
| Server firewall | The whole server | Blocking an address from everything, or limiting SSH to trusted IPs |
Bot blocking sits alongside them and stops crawlers by name. For most internal tools, password protection plus an IP bypass for the office is all you need.
Password protection
In the site’s settings, under Security, switch on Password protection. It uses HTTP Basic Auth: the browser asks for a username and password before the app sees the request at all, so it protects every page and every API route, including the ones the app forgot to protect.
Add a user for each person, with a name and a password. Passwords are stored encrypted and can’t be read back; to change one, delete the user and add them again. The optional Name field is the label some browsers show in the prompt.
Protection covers the whole site; it can’t be applied to one folder. Switching it on with no users shuts the site to everyone, which is useful while a tool is being retired.
Let your office straight through
Add your office or VPN addresses to the IP bypass list, and anyone connecting from them skips the password prompt. Everyone else still sees it, so people working from home sign in as normal.
One catch: the site’s preview URL may not work properly once an IP restriction is in place, because of the way preview URLs reach the server. Check the tool on its preview URL before you lock it down.
Block addresses outright
Under the same Security menu, IP blocking denies single addresses or whole ranges, written in CIDR notation (203.0.113.0/24), with a note to remind you why. If the site sits behind Cloudflare, Cito works out the real visitor’s address, so blocks still apply to the right people.
For something that should be shut out of the whole server rather than one site, use the server Firewall under Tools. It drops blocked addresses before they reach anything. It sees Cloudflare’s addresses rather than your visitors’, though, so for sites behind Cloudflare stick to per-site IP blocking.
The firewall can also restrict SSH to a list of trusted addresses. Add your own address first: home and mobile connections change address, and if you lock yourself out you’ll need to switch the restriction off from the dashboard.
Keep crawlers out
An internal tool has no business in search results or AI training data. robots.txt only asks crawlers to stay away, and plenty don’t listen. Bot & Crawler Blocking, also under Security, refuses them outright: any request whose user agent contains a blocked string gets a 403 Forbidden.
There are one-click blocks for the common AI crawlers (GPTBot, ClaudeBot, CCBot, Google-Extended, PerplexityBot and others) and SEO crawlers (AhrefsBot, SemrushBot and others). None of them block Googlebot or Bingbot. Password protection keeps all of them out anyway; bot blocking matters most for tools that have to stay public.
Sign-in inside the app
Password protection sits in front of the app. It doesn’t replace the app’s own sign-in: everyone who gets past the prompt reaches the same app, so if the tool shows different people different data, it still needs its own checks that each person only sees their own. That’s the gap coding agents most often leave, an API route that returns any record to anyone signed in. The readiness audit looks for routes that skip those checks.