HTTP Authentication

Monitor Password-Protected Pages

Website performance monitors can send an HTTP authentication header with every audit request. This lets you track pages that sit behind a login, such as staging environments, admin dashboards or member areas, the same way you monitor public pages.

Supported authentication types

• Basic Auth: enter a username and password and LoadFocus builds the Authorization: Basic header for you.
• Bearer Token: paste an API or access token and it is sent as Authorization: Bearer <token>.
• Custom Header: send any single header name and value, for example X-Api-Key, or a Cookie header for session-protected pages.
• Cookies: enter one name=value per line. They are sent as a Cookie header with every request of the audit, including third-party requests.

Steps to add authentication to a monitor

1. Open the New Website Performance Monitor Configurator and click New Test (or Create New, then Test).
2. Fill in the URL, name, location and device as usual.
3. In the Authentication (optional) dropdown, pick Basic Auth, Bearer Token, Custom Header or Cookies.
4. Fill in the credential fields that appear.
5. Run the test now or save it with a schedule. Scheduled runs keep using the saved authentication automatically.

Monitoring pages behind a session login

If your page uses a session cookie instead of Basic Auth or a token, log in with your browser, copy the session cookie from the developer tools, then pick Cookies under Authentication (optional) and enter your_cookie_name=your_cookie_value, one cookie per line. As long as the session stays valid, the monitor renders the logged-in page. If the session expires, the monitor quietly starts measuring your login page instead, so check the result screenshot if scores change unexpectedly.

Good to know

• The header is attached to every request Lighthouse makes during the audit, including assets loaded by the page.
• LoadFocus removes the header from the stored results and masks its value in the report. Values shorter than 8 characters are not masked, so avoid very short secrets in a custom header.
• Header values cannot contain single quotes or control characters, names are limited to 128 characters and values to 2048 characters.
• Combine authentication with alerts to get notified when a protected page slows down.