# Make this site private - not working

**URL:** <https://forum.ghost.org/t/make-this-site-private-not-working/39938>\
**Category:** Bugs\
**Created:** [July 18, 2023, 7:27pm UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938 "2023-07-18T19:27:10Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Joe\_Blocher](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/joe_blocher/32/25453_2.png) [@Joe\_Blocher](https://forum.ghost.org/u/Joe_Blocher)\
**Post date:** [July 18, 2023, 7:27pm UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/1 "2023-07-18T19:27:10Z")

</div>

I made this site private.  
But I cannot access the site with the given password.

The console output:  
21:12:44.666 localhost/:1 [DOM] Input elements should have autocomplete attributes (suggested: “new-password”): (More info: [Create Amazing Password Forms](https://goo.gl/9p2vKq)) \<input class=​"gh-input" type=​"password" name=​"password" autofocus=​"autofocus" placeholder=​"Password"\>​

 ![Bildschirmfoto 2023-07-18 um 21.13.59](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/3/9/39994a3fc71adf5c4e8baff4f4708d963f2181c1.png)

**Version:** [5.54.3](https://github.com/TryGhost/Ghost/releases/tag/v5.54.3)

---

<div class="post-metadata">

**Author:** ![Cathy\_Sarisky](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/cathy_sarisky/32/25750_2.png) [@Cathy\_Sarisky](https://forum.ghost.org/u/Cathy_Sarisky)\
**Post date:** [July 18, 2023, 7:37pm UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/2 "2023-07-18T19:37:22Z")

</div>

That’s an informative message from Google, not an error message.  
If it’s not working, you can still get to your admin pages at /ghost/ - once there, see if you can reset the private site password (which is not your Ghost password). I’m hoping you just have a typo in the password you set! :)

---

<div class="post-metadata">

**Author:** ![Joe\_Blocher](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/joe_blocher/32/25453_2.png) [@Joe\_Blocher](https://forum.ghost.org/u/Joe_Blocher)\
**Post date:** [July 18, 2023, 7:44pm UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/3 "2023-07-18T19:44:25Z")

</div>

It still not working. When I click the button “Access site -\>”  
The given password disappears and the border around the input is green. But nothing more happens.  
I am missing the redirect to my website.

 ![Bildschirmfoto 2023-07-18 um 21.40.19](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/e/5/e589b93fd3aed62843dde2e6f06ecf0c1931a995.png)

![Bildschirmfoto 2023-07-18 um 21.45.35](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/7/7/77bf7854f3044e9364a7183483716bb67f070b6d.png)

---

<div class="post-metadata">

**Author:** ![Kevin](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/kevin/32/32_2.png) [@Kevin](https://forum.ghost.org/u/Kevin)\
**Post date:** [July 18, 2023, 8:15pm UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/4 "2023-07-18T20:15:04Z")

</div>

It sounds like something may be blocking the cookie that is set to remember you’re logged in.

As a first step are you able to test in a different browser? If it works then that suggests there is an add-on or some privacy setting that’s preventing the cookie being set in your daily-use browser.

---

<div class="post-metadata">

**Author:** ![Joe\_Blocher](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/joe_blocher/32/25453_2.png) [@Joe\_Blocher](https://forum.ghost.org/u/Joe_Blocher)\
**Post date:** [July 18, 2023, 9:18pm UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/5 "2023-07-18T21:18:28Z")

</div>

You’re right:  
It don’t work in: Chrome, Opera  
It worked in: Safari, Firefox

In Chrome, the cookie is not set  
 ![Bildschirmfoto 2023-07-18 um 23.14.20](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/7/5/75b3ba392d5229d4a35edc6104a3e5ff9c485230.png)

In Firefox, the cookie is available:  
 ![Bildschirmfoto 2023-07-18 um 23.16.51](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/e/b/eb247f08b075c0375ef0e16efbacd85c95bc6a20.png)

But Chrome is my standard-browser - the latest version 115.  
I had no issues with cookies in other applications.  
I have no addon installed and the private settings allow all cookies.  
The Local storage contains the ghost-history. The Session storage is empty. The same as in Firefox.

---

<div class="post-metadata">

**Author:** ![Joe\_Blocher](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/joe_blocher/32/25453_2.png) [@Joe\_Blocher](https://forum.ghost.org/u/Joe_Blocher)\
**Post date:** [July 27, 2023, 1:52am UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/6 "2023-07-27T01:52:04Z")

</div>

I have found the bug.

Please update the code in  
**versions/5.54.4/core/frontend/apps/private-blogging/lib/middleware.js**  
row 58 - privateBlogging

` return session({ name: 'ghost-private', maxAge: constants.ONE_MONTH_MS, signed: false, sameSite: 'Lax' <----- row 58: instead of 'none' or delete this row })(req, res, next);`  
Or you can delete the row 58 because ‘Lax’ is the default value.  
You can’t code ‘Secure’ within a object (Secure: true will not work).

Works now in Chrome and Opera.  
See [https://web.dev/i18n/en/samesite-cookies-explained](https://web.dev/i18n/en/samesite-cookies-explained/#samesite=lax-by-default)

 ![x (1) Mark cross-site cookies as Secure to allow setting them in cross-site contexts](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/3X/4/d/4dfbeaea5f823f60d436cbe7ebf8aca0fb95a9cc.png)

---

<div class="post-metadata">

**Author:** ![Joe\_Blocher](https://sea1.discourse-cdn.com/flex015/user_avatar/forum.ghost.org/joe_blocher/32/25453_2.png) [@Joe\_Blocher](https://forum.ghost.org/u/Joe_Blocher)\
**Post date:** [July 27, 2023, 2:33am UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/7 "2023-07-27T02:33:02Z")

</div>

I have made a bug report in github.

---

<div class="post-metadata">

**Author:** ![hussainb](https://avatars.discourse-cdn.com/v4/letter/h/4491bb/32.png) [@hussainb](https://forum.ghost.org/u/hussainb)\
**Post date:** [October 14, 2023, 7:39pm UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/8 "2023-10-14T19:39:27Z")

</div>

hey, can you share your github bug report URL? I also faced the same issue and would like to +1 on your bug report.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex015/uploads/ghost2/original/2X/b/ba9ce5100b8bb264586f4f572545596b2ce3f081.png) [@system](https://forum.ghost.org/u/system)\
**Post date:** [January 12, 2024, 7:40pm UTC](https://forum.ghost.org/t/make-this-site-private-not-working/39938/9 "2024-01-12T19:40:03Z")

</div>

This topic was automatically closed 90 days after the last reply. New replies are no longer allowed.