Restrict access to a booking page

With the access restriction you open a booking page only to guests whose email address belongs to one of your own domains. Everyone else does not see the page’s content — no products, no prices, no rooms, no availability.

What you need the access restriction for

The typical case is an internal ordering page that is not meant for walk-in customers:

• Field sales and sales partners order through a page of their own that only works with a company address.
• Franchise and branch businesses see only the items meant for them.
• A customer with several locations releases purchasing only for the domains of their own houses.

The restriction applies to the booking page itself. The back office and the staff areas have always required a login and stay unchanged. If the field stays empty, the page is open as before.

Setting up access

1. Open Settings → Booking pages and click Configure on the page you want.
2. Switch to the Access section in the section bar on the left.
3. Enter one or more domains in the Access only for these email domains field, for example company.com. One domain per line.
4. Close the editor. The change is saved automatically as usual.

Subdomains are included automatically: if you enter company.com, then ch.company.com and sales.company.com get through as well. The reverse does not hold — if you enter only ch.company.com, then company.com stays out.

You can remove domains at any time. Adding them requires the Scale plan (see below). The page stays published; the restriction takes effect on the public page immediately.

What visitors see

Once the access restriction is set, a visitor sees only the page name and a field for their email address.

1. They enter their email address.
2. If the address belongs to one of your released domains, they receive a six-digit code by email. The code is valid for 10 minutes and there are 5 attempts.
3. After entering it correctly, this device — more precisely, this browser — is unlocked for this page for 30 days. During that time the guest gets in without a code.

Addresses from other domains never receive a code. The page deliberately does not say whether an address matches: someone who is not unlocked sees the same neutral reply after submitting as someone whose code is on its way. That way the page cannot be used to find out which domains are released.

As long as a device is not unlocked, the page shows no products, prices, rooms or availability, the AI chat stays off, and no inquiry or booking can be sent. The page also does not appear in the public event feed, in the website sitemap or in search engines.

If you remove a domain from the list again, unlocked devices of that domain lose access immediately — not only after the 30 days run out.

Embedded page on your website

If the booking page is embedded in your website via iFrame (see Embed your booking page in your website), the embedded area shows only a short notice and the button Open in new tab for restricted pages. The unlocking with the code happens in that new tab; afterwards the page is visible in the embedded area too.

The reason: unlocking depends on a cookie. Inside a foreign iFrame many browsers block such cookies, so the entry would fail for many guests there. Through the new tab it works reliably.

Which plan you need

The access restriction is part of the Scale plan (Enterprise included). Without the right plan you see the Access section with a notice and an upgrade link — the page stays open to everyone.

Two things apply regardless of the plan:

• Removing always works. You can delete a domain you have already set even if your plan no longer includes the feature.
• A restriction that is set stays active. If your workspace drops out of Scale, the domains you entered stay in place and guests still only get in with a released address and a code. The page does not quietly become public again.

Frequently asked questions

The code does not arrive. Check the spam and junk folder of your mailbox first. Also make sure you entered the address completely and without typos — including the domain. After that you can request a new code. If nothing arrives, contact the operator of the page.

I have a new computer or a new phone. The unlock is tied to the device and the browser. On a new device simply request a code again; on the old device the unlock stays until it expires.

I cleared my browser history. That also removes the cookies, and the page asks for a code again. That is not an error.

Is removing one domain enough? Yes. The unlock only counts while the domain is on the list. After removing it, the page is locked again for guests of that domain right away.

Does the restriction also cover the back office and staff areas? No. Those areas have always required a login; the access restriction applies to booking pages only.