If you've set a password in Project Settings → Access, first-time visitors are asked to enter it before anything loads. Once entered correctly, their session remembers it for that browser.