Guides · How to
How to review a website behind a login
Dashboards, web apps, staging sites and password-protected pages are the hardest to review. Why most feedback tools struggle with them, the workarounds people use, and the simple way that works with nothing to set up.
The pages that most need feedback are often the hardest to review. The admin dashboard. The new onboarding flow in the app. The staging site with a password on it. The feature behind a flag only three people can see. The error screen that only appears when a payment fails.
This guide explains why those pages trip up most feedback tools, the workarounds teams usually try, and the way that works with nothing to set up.
Why these pages are awkward
Plenty of feedback tools work by loading the website on their own servers and showing it to you in a review window, sometimes called a canvas or a proxy. That's fine for a public marketing page. But their server isn't signed in as you, so it sees the login screen, an empty dashboard or nothing at all.
Even when you can log in inside the tool, a few things tend to go wrong.
- Single sign-on and two-factor logins often refuse to work inside someone else's window.
- Staging servers block traffic from outside the company, so the tool needs its addresses allowed.
- Apps that depend on your session lose state, settings or data when loaded somewhere else.
- Security teams are understandably reluctant to hand a third party a working login.
The usual workarounds
| Workaround | What it involves | The catch |
|---|---|---|
| Share a test account | Create a login for the review tool | Another account to manage and secure |
| Allow the tool's IP addresses | Change the staging server's firewall | Needs an engineer, and some teams won't |
| Add a script to the site | Install the tool's snippet on staging | A code change, and it only covers sites you control |
| Screenshots in Slack | Capture and paste | Loses the link to the page, piles up fast |
Each of these is a small bit of setup or a small compromise. Added together, they're why so many app reviews end up as a pile of screenshots.
The simple way
Review the page in your own browser, where you're already signed in. A browser extension can add comments right there, because it only sees what you see, in the session you already have.
- Sign in to the app or staging site as you normally would, through whatever login it uses.
- Get the page into the state you want to talk about. The empty dashboard, the error, the half-finished form.
- Open Lasso with Alt+C (Option+C on a Mac) and click the element, or drag a box over an area.
- Type your note. Lasso pins it there and saves a screenshot of that spot, in that state.
- Share the collection with your team.
Nothing is installed on the site, no logins are shared, and nothing needs allowing on the server. It works the same on localhost, a preview deploy, staging and production, and for single sign-on and two-factor logins, because you've already done the logging in.
Teammates without access to the app can still read every note and its screenshot in the Lasso web app, reply and resolve. People who do have access can click a super link and land on the live page at the exact spot.
Who can see what
This is the question people usually ask next, so here's how it works.
| Person | Can they see the live page? | Can they see your comments? |
|---|---|---|
| You | Yes, you're signed in | Yes |
| A teammate with app access | Yes, after signing in | Yes, if the collection is shared with them |
| A teammate without app access | No | Yes, in the Lasso web app, with screenshots |
| Anyone else | No | No |
Tips for reviewing apps
Name the state, not just the screen. "Empty state when a new user has no projects" is easy to reproduce. "This page looks weird" isn't.
Mention the account type when it matters. Admin, member, free plan, trial. A bug that only shows for one role is a nightmare to find without that detail.
Use demo data for screens with customer information. The screenshot captures what's on screen in the spot you click, so treat it like any screenshot and avoid real personal data.
One collection per review round. The second pass then doesn't get tangled up with the first, and you can see what's left from each.
Check the fix where you found it. Open the comment's super link after it's resolved and look at the live page. It takes ten seconds and catches the fixes that only half landed.
Handing it to whoever fixes it
If a developer or an AI agent is going to do the fixing, Export for AI hands them every note with the page, the exact element and the screenshot. They don't need to log in to understand the problem, because your signed-in view is already in the screenshot. There's more on that in our guide to sending feedback to ChatGPT, Claude or Cursor.
Questions people ask
Can I leave feedback on a password-protected staging site?
Yes. A browser extension like Lasso runs in your own browser after you've signed in, so it can comment on anything you can see, with no credentials shared with anyone.
Does Lasso work on localhost?
Yes. Lasso runs on any page your browser can open, including localhost and preview deploys.
Will my teammates need the same login to see my comments?
To open the live page, yes, because it's behind your login. They can still read every comment and its screenshot in the Lasso web app without signing in to the site.
Does a feedback extension see my passwords?
Lasso only reads the page you choose to comment on when you comment, to anchor the note and take the screenshot. It doesn't need or store your login for the site.
What about pages with personal or customer data on them?
The screenshot captures whatever is on screen in the spot you click. Use a test account or demo data when reviewing screens with real customer information, the same as you would for any screenshot.
Can I review a page that only appears in a certain state, like an error?
Yes. Get the page into that state in your own browser, then comment. The screenshot records the state, which is far more useful than describing it.