Does Framer Have User Login? Members-Only Pages in 2026

Not natively. As of November 2026, the only login-style feature built into Framer is Password Protection: one shared password in front of the whole site, which Framer says "does not create individual users, roles, or account-specific access controls." Sign-up, login, members-only pages and paid access come from third-party tools that document Framer support, such as Outseta, FrameAuth, Thenty, MemberSpace, Descope and PageLock. The other route is to move the site into code, for example a Next.js project, and add an auth library such as Better Auth, Clerk or Supabase Auth.

What Framer has built in

Password Protection: one password for the whole site

Framer's Academy lesson Password-protect your site in Framer covers the feature (it dates from 2023, and Framer notes some of the UI may have changed since June 2026). You open the project settings, go to the General tab and turn on Password Protection. Framer generates a password, and you can keep it or replace it with your own. Three details from the lesson matter in practice:

• No republish needed. "Enabling, editing, or disabling Password Protection updates the site without another publish."
• Visitors aren't asked every time. The browser remembers the password during normal use, but after you republish, visitors have to enter it again.
• It isn't a login system. In the lesson's words, it "places one shared password in front of the site." There are no individual users, so you can't see who came in, and you can't lock out one person without changing the password for everyone.

The lesson describes a password for the site, not for single pages. Per-page and per-CMS-item passwords come from plugins (below).

Plans. Framer's pricing page lists "Password protect" ("Protect your site with a password") with a tick for the Basic, Pro and Enterprise plans as of November 2026. The Free plan card doesn't list it.

What Framer doesn't have

Framer's pricing page lists no visitor accounts, memberships or paid-access features on any plan. Enterprise does list SSO and SCIM, but those are for your team, not your visitors: Framer's security page says its SSO lets companies "manage their team members' access" to Framer. Framer's Firewall, on the Advanced Hosting add-on and Enterprise, can block or redirect visitors by country and path, but it doesn't know who anyone is.

Framer does have a Marketplace category called Login and Membership Components, with password gates, sign-in screens and members-only sections. Everything in it is made by third parties.

Third-party tools that document Framer support

Each tool below has Framer setup instructions on its own site or a Framer Marketplace listing it publishes. Prices are from each vendor's pricing page (PageLock's from its Marketplace listing) as of November 2026.

Tool	How it connects to Framer	What it can gate	Pricing
Outseta	Marketplace plugin that adds Outseta's script to your site's header, plus signup, login and profile embeds	Pages or whole folders by URL, per subscription plan; others can be sent to an "Access Denied" URL	Pricing: 14-day free trial; Start plan $47/month, or $37/month billed yearly, plus a 2% transaction fee
FrameAuth (formerly FramerAuth)	Plugin plus drag-in components (sign in, one-time code, sign up, profile) and code overrides	Whole pages (visitors without access go to /sign-in), sections of a page, access by tag or by purchase through Stripe or Lemon Squeezy	Pricing: 14-day free trial; price depends on member count; 0% commission
Thenty	Plugin plus components; Thenty says it isn't compatible with other site builders	Pages and sections for free, paid, tiered or invite-only members; Stripe payments	Pricing: 14-day free trial; 1.5% transaction fee
MemberSpace	Install code pasted into the "Start of <head> tag" box in Framer's custom code settings; needs Framer Basic or higher	Members-only pages, plus files you upload to MemberSpace itself	Pricing: 7-day free trial; Starter $39/month billed annually, plus a 5% fee
Descope	Plugin plus a code override file (DescopeAuth.tsx)	Pages and components by login status (protectedPage, protectedComponent); SSO over SAML and OIDC	Pricing: Free Forever plan up to 7,500 monthly active users
PageLock	Plugin; PageLock says locked pages are served from a secure server only after sign-in	Single pages, page groups, CMS collections or single CMS items, by PIN, password, username or magic link	No charge for PIN locks on your staging domain; Pro is $15.99/month or $159/year for custom domains

A few notes from the vendors' docs:

• Outseta protects content in groups. You list "Hidden URLs", choosing "Starts with" for a folder or "Equals" for a single page (Set up protected content). Its embeds don't work in Framer's preview mode, so you test on the published site.
• FrameAuth locks pages from its dashboard. Its page-locking guide says a locked page is open to any signed-in member by default, and tags narrow it to buyers of a product or a group you assign. A separate guide uses one shared FrameAuth account to put a single password on selected pages.
• Descope's Framer listing offers single sign-on with existing identity credentials, "both SAML and OIDC supported", which matters if members log in with a company account. As of November 2026, its Framer docs page carries a warning that Framer "is currently having issues with their package management service", with a workaround guide.
• Login forms alone. Some Marketplace components only give you the form. The free Supabase Auth. component is "a reusable login form" connected to your own Supabase project; its listing doesn't describe protecting any pages.

Hiding content is not the same as protecting it

OWASP's Top 10:2025 entry A01, Broken Access Control, puts it plainly: "Access control is only effective when implemented in trusted server-side code or serverless APIs, where the attacker cannot modify the access control check or metadata." If a page's content reaches the browser and a script then hides it, someone who reads the page source or turns off JavaScript can get to it.

Several of the vendors above say this themselves:

• Outseta says it "uses Javascript to protect your content" and offers an enhanced protection script for visitors who disable JavaScript. Its server-side protection guide separates soft gating, which "hides content client-side", from hard gating, which "verifies the user on the server before sending content".
• MemberSpace says of locked pages: "because this protection relies on JavaScript, it's possible for tech-savvy users to bypass it." It adds that certain text and files hosted directly on your site "may still be discoverable through the page's source code", and calls uploading files into MemberSpace the most secure option (MemberSpace security).
• The PIN Page Lock component describes itself as client-side and says it "shouldn't be used for protecting highly sensitive information that requires server-side authentication" (listing).
• PageLock describes its product as the server-side kind: its listing says it serves locked pages "from a secure server only after a visitor signs in", so the content isn't in the page's HTML.

For a members' newsletter archive or course previews, client-side gating is usually an acceptable trade. For client documents, personal data or paid downloads people would happily share, keep the content somewhere a server checks the login first: the vendor's own file storage, a tool that says it checks on the server (such as PageLock), or your own code.

Gated downloads

A "members-only download" is only as private as the file's URL. FrameAuth's download button guide attaches the file to a Framer CMS field and gates the button with a locked variant, so the lock is on the button. MemberSpace's advice is to upload PDFs and other files into MemberSpace rather than host them on your site. In your own code, you serve the file from a route that checks the session first.

The code route: export to Next.js and add authentication

Framer itself has no export. Its help center says: "Framer does not offer HTML export for self-hosting" (Framer Help). Our Framer export guide compares the ways to get a site out.

FNJ converts a published Framer site, from its public URL, into a Next.js project you own. That gives you React components you can extend, but FNJ doesn't add login for you: authentication is code you or a developer add afterwards. Two other things to know first:

• The exported project still loads Framer's runtime script and fonts from Framer's CDN. Pages and images are copied into the project; the animation runtime and fonts are not.
• Framer's password setting stays behind. It belongs to Framer's hosting, so the exported project has none. Our post on Framer password protection after export covers how to rebuild it.

The steps, realistically

1. Convert the site and run the project locally. A conversion needs a paid FNJ plan.
2. Pick an auth library. Next.js's authentication guide recommends using one "for increased security and simplicity" and lists Auth0, Better Auth, Clerk, NextAuth.js (Auth.js), Supabase and others. Three common picks:
   • Better Auth: install better-auth, set BETTER_AUTH_SECRET and BETTER_AUTH_URL, create an auth.ts instance connected to a database, and mount its handler at app/api/auth/[...all]/route.ts. Better Auth now maintains Auth.js (NextAuth): the Auth.js docs say "The Auth.js project is now part of Better Auth", and Better Auth's announcement says it will keep shipping security patches for existing Auth.js apps, but "we strongly recommend new projects to start with Better Auth".
   • Clerk: install @clerk/nextjs, call clerkMiddleware() in proxy.ts (middleware.ts on Next.js 15 and earlier), and wrap the app in <ClerkProvider>. We found no Framer guide in Clerk's docs, which is why it isn't in the table above.
   • Supabase Auth: install @supabase/supabase-js and @supabase/ssr, add the project URL and key to .env.local, and add a proxy.ts (middleware.ts on Next.js 15 and earlier) that refreshes the session.
3. Add sign-up and sign-in pages. Use the library's components or build forms in the converted site's style.
4. Check the session on the server. Next.js suggests a proxy for quick redirects and for protecting static pages, but warns: "While Proxy can be useful for initial checks, it should not be your only line of defense in protecting your data." Do the real check in the page or data function. Supabase is explicit about its own API: "Never trust supabase.auth.getSession() inside server code such as Proxy." It says to use supabase.auth.getClaims() to protect pages instead.
5. Serve gated files through a route that checks the session. Next.js says to treat Route Handlers "with the same security considerations as public-facing API endpoints."
6. Connect payments if you're selling access. You'll need to record who paid on the user's account.
7. Deploy to a host that runs Next.js, such as Vercel or Cloudflare. A static HTML export has no server code, so it can't check a login.

A members page with Better Auth looks like this, following the Server Component example in its Next.js integration docs:

// app/members/page.tsx
import { headers } from "next/headers"
import { auth } from "@/lib/auth" // your Better Auth instance
import MembersArea from "@/components/MembersArea" // your gated content

export default async function MembersPage() {
  const session = await auth.api.getSession({ headers: await headers() })
  if (!session) return <div>Not authenticated</div>
  return <MembersArea />
}

The check runs on the server, so visitors who aren't signed in never receive the members' content. The cost of this route is ownership: you now run a user system (or pay a provider for one), handle password resets and account emails, and keep the libraries up to date. For a small private area on a converted marketing site, that's a contained job for a developer. For a full membership business with billing, a plugin built for it may be less work. Our Framer to React guide covers what you get in the converted code, and its limits.

Choosing between them

If you need	Start with
A private preview for a client or a launch you're not ready to show	Framer's own Password Protection
Passwords on single pages or single CMS items	PageLock, or FrameAuth's shared-password setup
Free sign-ups, a gated blog or newsletter, a paid course	Outseta, FrameAuth, Thenty or MemberSpace
Company logins through SAML or OIDC	Descope
Private documents, per-user data or app features	The code route, with server-side checks

If you're weighing whether to stay on Framer at all, our page on Framer's limitations sets out its plan limits in one place.

One caution before exporting a site that already uses a membership plugin: these tools are documented for sites published on Framer. Ask the vendor whether a copy hosted elsewhere is supported before you rely on it.

Frequently asked questions

Does Framer have built-in authentication?

No. As of November 2026, Framer's only built-in login-style feature is Password Protection, a single shared password for the whole site on the Basic, Pro and Enterprise plans. Framer says it does not create individual users, roles or account-specific access. User accounts come from third-party tools or your own code.

Can I add a login page to Framer?

Yes, with a third-party tool. Outseta, FrameAuth, Thenty, MemberSpace and Descope all document how to add sign-up and login to a Framer site, through a Marketplace plugin or code pasted into Framer's custom code settings. Member accounts are stored by that vendor, not by Framer.

Can I sell members-only content on a Framer site?

Yes, through a membership tool that handles payments. Outseta and Thenty sell access through Stripe, FrameAuth through Stripe or Lemon Squeezy, and MemberSpace sells one-time, payment-plan and recurring memberships. Each charges a subscription, and as of November 2026 Outseta, Thenty and MemberSpace also add a transaction fee on their entry plans.

Is Framer password protection secure enough for private content?

It suits previews and client review. Everyone shares one password, so you can't see who signed in or remove one person's access without changing it for everyone. For confidential documents or personal data, use a tool with individual accounts that checks access on a server, or move the content into code you control.

Can I password-protect a single page in Framer?

Not with Framer's built-in setting, which Framer's lesson describes as one password in front of the site. Plugins add this: PageLock locks single pages, page groups and individual CMS items, and FrameAuth documents a shared-password setup for selected pages. Drop-in lock components exist too, but check how they work: PIN Page Lock, for example, covers the whole site with an overlay in the browser and says it shouldn't be used for highly sensitive information.

Can I add authentication after exporting Framer to Next.js?

Yes. An FNJ Next.js export is a Next.js project of React components, so you can add Better Auth, Clerk, Supabase Auth or another library from Next.js's list, then check sessions on the server. FNJ doesn't add login for you, and Framer's password setting doesn't come with the export, so plan for a developer to do this part.

If you want the code route, start with FNJ's Framer to Next.js converter: it turns your published Framer site into a Next.js project you can deploy to your own host and extend with the authentication library you choose.