Category passwords: not prompting, not unlocking, or re-asking Pro

A password-protected category is hidden from everyone who hasn’t unlocked it — its documents disappear from libraries, search and widgets rather than showing a locked row. That surprises some people ("where’s the prompt?"), so here’s how the pieces fit and what to check when it misbehaves.

"Visitors never see a password prompt"

By design, a protected category doesn’t advertise itself inside the library — its documents simply aren’t there until unlocked. The prompt lives on the category’s own page. Share that category link with the people who should have the password; once they unlock it, its documents appear everywhere for them.

If you want a visible-but-locked pattern instead ("this exists, log in to open it"), restrict documents to logged-in users rather than a category password — those show with a lock.

"It asks for the password again straight away"

A successful unlock sets a browser cookie that lasts 24 hours. If the prompt returns immediately:

• Page caching is the usual culprit. A full-page cache can serve the locked version of a page to someone who just unlocked it (or worse, the unlocked version to everyone). Exclude the protected category’s pages from your cache plugin or CDN page cache, or exclude visitors carrying a filedeck_cat_* cookie — most cache plugins have a "don’t cache when cookie matches" rule.
• Cookie-blocking browsers or privacy extensions will also drop the unlock. The cookie is first-party, HttpOnly and secure over HTTPS; nothing about it is tracking-related, but strict blockers don’t ask.

"The right password stops working after a few tries"

Wrong guesses are rate-limited to blunt brute-force attempts, and the limit is shared rather than per-IP so a distributed guesser gains nothing. If someone fat-fingered the password repeatedly, have them wait a few minutes and try once, correctly.

"I changed the category password — who’s still in?"

The unlock cookie is bound to the stored password, so changing the password invalidates every outstanding unlock immediately. Anyone with the old password is re-prompted on their next visit.

Embeds never unlock

Libraries embedded on another site (Publish & embed) render as an anonymous visitor and can’t carry unlock cookies across sites — protected categories are always excluded there. That’s deliberate: a cross-site iframe that could hold unlocks would leak between viewers.

Still stuck? Email support@getfiledeck.com and mention your caching setup — it’s the answer more often than not.