How to limit access to approved email addresses

Available on Pro and above.

Email protect lets only the email addresses you list open your project. Visitors confirm their address with a one-time code, and anyone not on your list is turned away.

How it works for visitors

They open your link and enter their email address.
If the address is on your list, we email them a one-time code.
They enter the code and your project opens.

They don't need a Tiiny Host account or a password.

Turn on Email protect

First, find the access setting:

New upload: Open the Access gate dropdown on the upload screen.
Live project: Click Update → Customize project. Under Access Settings, open Access Mode.

Then:

Choose Email protect.
In Emails to allow, add each address you want to let in. You need at least one.
Click Publish.

Change who can get in

Go back to Emails to allow, add or remove addresses, and click Publish. Changes only apply after you publish.

Removing an address stops that person from requesting new codes, but if they've already signed in on a device, they may still get in for a while.

If you need to remove someone's access urgently, see The fastest way to reach us.

Turn it off

Under Access Settings, change Access Mode to another option, such as Public (No restrictions) or Password Protect, and click Publish.

Good to know

Add full addresses, like name@company.com. Whole domains, like @company.com, don't work.
Capital letters don't matter. Name@Company.com and name@company.com are treated the same.
You'll get an email each time someone signs in. Each address that signs in is also saved, the same way Capture Emails saves addresses. The Download collected emails option only appears for Capture Emails projects, so you can't download the list from an Email protect project.
Email protect isn't available for projects that run server code, like PHP, Python, Node.js or React apps.
Capture Emails is different. It lets anyone in after they enter an email, and collects the addresses. Email protect only lets in the people you list.

Click Update, then Customize email whitelist page. It opens the same editor you use for the email capture page.

A visitor can't get in

They see "You do not have access to this website". Their address isn't on your list. Check the spelling, or add the address they're using and click Publish.
No code arrived. Ask them to check their spam folder and confirm they typed the exact address on your list.
They see "OTP invalid". The code is wrong or has expired. Codes last 10 minutes, so they can request a new one.

Updated on: 13/10/2026

Was this article helpful?

Thank you!