---
schema_version: "1"
id: da2350cf19f7df99d0c0938884462774749c8abaec8f4c54ea5b55ba4e7a2c4e
title: Set Protection Flags and Assign Passwords
collection: admin
version: current
locale: en-us
portal_url: https://docs.salesforce.com/admin/current/en-us/cc/264-0-0/b2c_setting_protection_flags_and_assigning_passwords.md
canonical_url: https://help.salesforce.com/s/articleView?id=cc.b2c_setting_protection_flags_and_assigning_passwords.htm&release=264.0.0&type=5
source_site: help.salesforce.com
content_type: documentation
content_hash: b8e13e9785f73cec7d7b405c1357762a455cea5649344e54efd77011ef2bae9e
description: When you create a B2C Commerce site, there’s no password protection enabled by default. The administrator must set the protection flag and assign a password.
products:
  - Commerce
  - B2C Commerce
release: "264"
---
# Set Protection Flags and Assign Passwords

When you create a B2C Commerce site, there’s no password protection enabled by default. The administrator must set the protection flag and assign a password.

1. Click App Launcher ![App Launcher](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/cc/b2c_merchandiser_administrator/images/appLauncher.png), and then select **Administration** | **Sites** | **Manage Sites** | **site** | **Site Status**.
2. On the Site Status tab, set the Site Status to Online (Protected).
3. Select **Access using shared password**
4. Enter a password in the Password field.
    
    Specify a password that meets the following requirements:
    
    - Non-empty string
    - Characters a-z, A-Z, and 0-9
    - There’s no minimum or maximum length
    - The password never expires
        
        ![Note](https://sf-zdocs-cdn-prod.zoominsoftware.com/tdta-cc-b2c_merchandiser_administrator-264-0-0-production-enus/ea76f372-6cfa-42a6-8e7c-05c6df7abed8/images/icon_note.png)
        
        Note If the flag isn't set, the password field can be empty.
    
    For storefront applications that enforce mappings between email address and username, login attributes are required to support any character that is valid in an email address. The following special characters are allowed for usernames and customer logins.
    
    ``#!&$%*+/?=^`~}|{``
    
    This allows the use of all supported email address formats as user and customer logins.
5. Click **Apply**.