Thanks for the insight. I’m not worried about people logging in from different locations to be honest. The access would pretty much just be for the day then that’s it. My main concern (or I guess I could say wish) is that I can leave the site “exposed” to the internet without having a bunch of bots scanning it all the time. So I was hoping for some kind of solution where the site would be completely hidden until someone authenticates themselves. I mentioned IP whitelisting because that’s all I could think of, but maybe there would be another way? Or maybe what I’m asking just isn’t possible?