What stays open
Admin login, admin panel, and the Stripe webhook stay available.
What gets blocked
The public storefront routes are protected until the password is entered in this browser session.
How it works
Set PUBLIC_SITE_PASSWORD in your .env file. If that value is blank, the gate is disabled.