# Limit Access to a Storefront Under Development

To limit access to a storefront under development so that only users from your organization can view it, enable Protected Storefronts in Business Manager for the associated site. The protected storefront's environment requires a basic auth password that organization users provide.

:::important
Protected Storefront is enabled by default for new Managed Runtime environments.
:::

## Enable a Protected Storefront

1. (Optional) For storefronts not created in Business Manager or through storefront export & import, link them to Business Manager.

   Before linking, make sure the correct B2C Commerce instance and site IDs are configured for the MRT environment. To verify these settings in [Runtime Admin](https://runtime.commercecloud.com/login), go to the project and environment, and then click **Environment Settings**.

   For linking steps, see [Link an Existing Storefront to B2C Commerce](/docs/commerce/b2c-commerce/guide/sfnext-link-storefront.md).

2. Set the site status and options.

   a. In **Administration > Sites > Manage Sites**, click the site, and then click the Site Status tab.

   b. For the Site Status, select `Online (Protected)`.

   c. Select **Access using shared password**.

   ![Select a site status and shared password for the protected storefront](https://a.sfdcstatic.com/developer-website/sfdocs/commerce-cloud/media/sfnext/sfnext-site-settings-updated.png)

   d. Enter a shared password.

   e. Select **Apply to Composable Storefront and StorefrontNext**. This ensures all environments associated with the site require a password.

   This option is available starting with release 26.8. On earlier releases, this checkbox doesn't appear.

   f. Deselect **Access using user’s password or access key** and **Access using Storefront Toolkit** — these options don’t apply to PWA Kit storefronts or Storefront Next. Click **Apply**.

   Changes can take up to 5 minutes to take effect.

## Limitations

- Protected Storefronts support only the shared password option.
- For multi-site storefronts, enabling Protected Storefront on any one of the associated sites results in the environment requiring a basic auth password. If sites are configured with different passwords, the environment accepts any of the passwords.
- For sites associated with multiple MRT environments, enabling Protected Storefront results in all environments requiring a basic auth password.
- For sites with Protected Storefront enabled before you associated a Managed Runtime environment, disable and re-enable the Protected Storefront settings for the changes to take effect.