Should a wedding website be private or password protected?

01What a public wedding site tells strangers

Wedding addresses are easy to guess: a Show HN project finds random wedding websites by trying popular first-name pairs against common address patterns. Once found, a public site often shows the date, venue, schedule, hotel and sometimes the honeymoon. That is enough to tell someone when a home will be empty or where a group of people will be with gifts.

When a couple shared their site on Hacker News, one commenter worried about publishing the date and place openly; another replied that newspapers have always printed the same details. Both are right: the risk is small for most couples, and a password costs guests a few seconds.

02How the platforms handle privacy

Zola offers optional password protection for the site. Joy lets you protect all sections or only specific pages, and show particular events only to the guests invited to them. The Knot offers a password option too. General builders such as Squarespace can password-protect pages, and a site you host yourself can be kept out of search results with a noindex tag.

03What to protect, and what to leave off entirely

Put the venue, schedule, hotel blocks and registry behind the password. Leave some things off the site completely, password or not: home addresses, honeymoon dates and bank details. What to put on a wedding website has the full list.

If you build your own site, adding a noindex tag tells Google not to show it in results, as described in Google's documentation. Noindex is not a lock; anyone with the link can still visit, so use a password for the details.

04Protect the account as well as the site

In May 2022 attackers got into some Zola accounts using passwords leaked from other websites and ordered gift cards with registry money. Zola said fewer than 0.1% of accounts were affected, reset passwords and refunded the orders, and The Record reported about 3,000 accounts with compromised activity. The fix is the same anywhere: a unique password for the wedding account and two-factor sign-in if offered.

05How to set it up without annoying guests

A password only causes trouble when it is hard to find or hard to type. Print it next to the website address on the invitation, keep it short and lowercase, and test it on a phone. Make the public home page say "The password is on your invitation" so nobody is stuck.

If you used a custom domain, check that the password screen appears after the redirect, not before. Custom domains for wedding websites covers how the redirects work on each platform.

06Public or private: a quick rule

If the site only has names, date and city, public is fine. Once it lists the venue address, times and hotel, protect those pages. If it mentions when you are away, take that line off.