Password Protection & Advanced Settings

Every ScaanMe vCard is public by default — anyone with the link, QR, or NFC tap opens it instantly. The Advanced Settings page is where you take back control: you can lock the whole card behind a password so only people who know it get in, and you can fine-tune the technical side of the card — installable PWA mode, an Arabic/English language switcher, a custom favicon and SEO tags, and even your own custom CSS/JS. Think of it as the card's privacy-and-engineering room: cosmetic on the surface, powerful underneath.

Password protection is for anyone who wants a private or semi-private card: a VIP rate sheet you only share with select clients, an internal team directory, an event card meant for invited guests, a pricing card you don't want competitors scraping, or simply a card you want to soft-gate before launch. The advanced toggles are for owners who want the card to feel like a real app (PWA), to serve a bilingual audience (language switcher), or to be found cleanly on Google and in chat-link previews (SEO + favicon).

Two things decide what you'll see on this page, and both come from your plan: the password_protected flag unlocks the password section, and the advanced_settings flag unlocks PWA, language switcher, custom CSS/JS, and SEO. If your plan has neither, ScaanMe quietly skips this step and sends you back to your cards list — so if the Advanced Settings page looks empty or you can't reach it, that's a plan limit, not a bug. Each section below tells you which flag it needs.

What & why: Advanced Settings is the last section of the card editor, so you reach it the same way you reach any other section — by editing the card. Reaching it through the editor (rather than a standalone URL) matters because the page reads your card and your plan together: it only renders the controls your plan actually includes, and saving here routes you forward through the rest of the editor flow.

From the dashboard open My Cards, find the card you want, and click Edit. In the editor's left-hand section navigation, click Advanced Settings (the last item in the list). The page opens at a URL like user/edit-advanced-setting/{card}. If the card was never finished, finish the basic details first — the editor expects a real card before it shows this page.

At the top you'll see a row of toggles (the privacy and feature switches), and below them — if your plan includes advanced settings — sections for Set Password Protection, Custom CSS / JS, and SEO Configuration Settings. A green success banner appears after each save; a red banner appears if something was rejected (for example an over-length meta tag). Nothing on this page is destructive: you can toggle and re-save as often as you like.

What & why: Password protection puts a lock screen in front of your entire card — no name, no links, no content shows until the visitor types the right password. It requires the password_protected plan flag; if your plan doesn't have it, the password row simply won't appear. The control is deliberately named in the negative — "Disable Password Protection" — because by default a card has no password, so the switch starts in the "disabled" (on) position.

Find the Disable Password Protection switch in the top toggle row. Because it's a "disable" switch, a card with no password shows it on (green). To add a password, turn this switch off — the moment it flips off, a Set Password Protection panel appears below with a Password field. This inverted logic trips people up at first: off = protected, on = open. If you ever want to remove the lock later, just turn the switch back on and save.

In the Password field, type the password visitors will need. It must be between 3 and 20 characters — short PINs and memorable phrases both work, but a slightly longer mix is safer for anything sensitive. Use the Show Password link beside the field to reveal what you typed and catch typos before saving; click it again to hide. There's no "confirm password" field, so the Show Password check is your safety net — a typo here locks even you out of the card preview.

Click Save at the bottom. ScaanMe hashes the password with bcrypt before storing it — your plaintext is never kept in the database, so even staff can't read it back; you'll only ever set a new one, not "view" the old one. Edge case: because the stored value is hashed, if you forget the password the fix is simply to type a fresh one and save again. The card is now locked, and the next visitor will meet the password screen.

Important auto-unlock edge case: if your plan later loses the password_protected capability (for example a downgrade), ScaanMe will clear the password automatically the next time the card is viewed, so the card never becomes permanently stuck behind a lock you can no longer manage. Re-add the password whenever your plan supports it again. This is a safety behavior, not something you trigger — but it's worth knowing so a downgrade doesn't surprise you.

What & why: It helps to know exactly what your locked card looks like from the outside, so you can brief the people you share it with. The lock is a full-screen gate, not a partial blur — until the password is entered, none of your real content is loaded onto the page at all, which is why password protection is genuinely private and not just hidden visually.

When someone opens a protected card, they see a clean "Password Protected" modal centered on the screen with the prompt "Enter your vcard Password" and a single password box. The modal is styled to match the card's theme colors, so it still feels like part of your brand. There are no hints, no "forgot password" link, and no way around it — this is intentional, since the whole point is that only people you've given the password to can proceed.

When the visitor types the password and submits, ScaanMe checks it (it accepts both the current bcrypt-hashed form and any older plaintext password from before hashing was added, so legacy cards keep working). On a correct password, the gate disappears and the full card loads; their browser remembers they unlocked it for the session, so they won't be asked again on every page. On a wrong password, the card reloads with the message "Incorrect vcard password." and the gate stays up — they can simply try again.

Two things worth telling your visitors: the unlock lasts for their browser session, so closing the tab and coming back later may ask for the password again, and the lock applies on whichever URL they use — your main link, a custom domain, or a subdomain all gate the same way. Because the unlock is stored per browser, sharing the password with a colleague still requires that colleague to enter it once themselves; it isn't a one-time global unlock.

What & why: Alongside the password switch sit a few feature toggles that change how the card behaves rather than who can see it. Enable PWA and Enable Language Switcher require the advanced_settings plan flag; the Show this vCard publicly? (directory) toggle only appears if your platform has the Directory plugin installed. Each is a single on/off switch with an immediate, real-world effect on the public card.

Enable PWA turns your card into an installable Progressive Web App. When it's on, visitors on a phone get an "Add to Home Screen" style prompt, and once installed your card opens like a native app — full-screen, with its own home-screen icon, no browser bar. This is ideal for cards people return to often (a clinic's booking card, a store, a membership card). Leave it off for one-time-scan cards where an install prompt would just be noise.

Enable Language Switcher adds an Arabic/English toggle to the public card so bilingual visitors can read it in their preferred language. There's an important condition: the switcher only actually appears to visitors when your card (or its content) has Arabic translations filled in — turning the switch on with no Arabic content does nothing visible, by design, so you never show an empty language option. Translate your title, sub-title, and key fields first, then enable this to surface the choice.

Show this vCard publicly? (when present) controls whether your card is listed in the platform's public website directory — a browsable gallery of cards. On means anyone browsing the directory can discover you; off keeps the card reachable only by your own link/QR. Use it on if you want extra organic discovery, off for a private or client-only card. If your platform doesn't run a directory, you simply won't see this toggle at all.

All toggles save together with the Save button at the bottom of the page — there's no separate per-switch save. A subtle gotcha with on/off switches: an unchecked switch isn't "unchanged," it's actively saved as off. So if you flip several switches and only meant to change one, double-check the others before saving, because the page writes the exact state of every toggle each time you submit.

What & why: The SEO Configuration Settings section (requires advanced_settings) controls how your card looks when it's shared in chat, posted on social, or indexed by Google. These are the little details that make a link look professional: the small icon in the browser tab, the bold title and grey description in a WhatsApp/Telegram link preview, and the words search engines associate with your card. Filling them in is optional but strongly recommended for any card you market.

Favicon — click the file picker and upload an image (a PNG is ideal). This becomes the tiny icon in the browser tab and is also used as the link-preview image when there's no custom one, so a clean square logo works best. ScaanMe stores it under your card's assets automatically; you only need to re-upload when you want to change it. Leaving it empty falls back to your card's profile image, so an upload here is only needed when you want a distinct icon.

Meta Title is the headline shown in a search result and in link previews. Keep it under 70 characters — the page rejects anything longer with the message "Meta title must not exceed 70 characters." Write it like a real headline: your name or business plus what you do (e.g. Dr. Sara Adel — Pediatric Dentist, Cairo). If you leave it blank, ScaanMe falls back to your card's own title, so this field is for when you want the SEO headline to differ from the on-card title.

Meta Description is the grey summary line under the title in previews and search. Keep it under 160 characters (the page enforces this) and write a single inviting sentence about who you are and why someone should tap — think of it as your card's elevator pitch. A good description noticeably lifts how many people click a shared link, so it's worth a moment's thought rather than leaving it empty.

Meta Keywords is a comma-separated list of terms describing the card, capped at 70 characters. A small convenience: typing a space automatically inserts a comma, so you can type keywords naturally. Be honest, though — Google ignores meta keywords entirely, so this field carries almost no SEO weight today; it's optional and mostly there for completeness or internal search. Spend your effort on the title and description, which actually move the needle.

What & why: The Custom CSS / JS section (requires advanced_settings) lets developers inject their own styles and scripts into the public card. CSS lets you override fonts, colors, spacing, or hide an element the theme doesn't expose; JS lets you add behavior or a third-party widget. Each box accepts up to 25,000 characters. This is a power-user tool — most owners never need it, and you can run a beautiful card without ever opening it.

To use it, paste your rules into the Custom CSS box (no <style> tags needed — just the rules, like .profile-name { letter-spacing: .5px; }) and your code into the Custom JS box. Both fields are monospaced for readability. After saving, open your public card in a fresh tab to confirm the effect; if a style doesn't seem to apply, it's usually a specificity or selector issue rather than the field not saving.

Two cautions. First, test on a real device — custom JS runs on every visitor's phone, and a broken script can break the whole card, so keep it minimal and defensive. Second, only paste code you understand and trust; never drop in a random snippet from the internet, since it executes with full access to your public page. If something goes wrong, simply clear the box and save to remove it instantly.

Note on marketing pixels: if you're looking for Meta Pixel, Google Analytics, Google Ads, or TikTok Pixel fields, they are not on this page. To keep a single clean home for tracking, ScaanMe manages those per-card pixels under CRM → Integrations. Don't try to paste a tracking pixel into Custom JS as a workaround — use the dedicated Integrations screen so consent handling and CRM attribution work correctly.

Remember the inverted password switch. The control is "Disable Password Protection", so off means protected and on means open. After setting a password, glance at the switch state before saving — the single most common mistake is leaving it on (open) and wondering why the card never asks for a password.

Use Show Password and test in a private window. Since there's no confirm field and you can never read the password back, click Show Password to verify your typing, then open the card in a private/incognito window and actually enter the password yourself. That round-trip catches typos and confirms real visitors will get in.

Translate before enabling the language switcher. The switcher only shows up when Arabic content exists, so flipping it on with an English-only card does nothing. Fill in your Arabic translations first, then enable it — and verify both languages read naturally on the live card, not just in the editor.

Spend your SEO effort on title and description. Meta keywords are ignored by Google, so don't over-invest there. Instead write a sharp Meta Title (under 70 chars) and an inviting Meta Description (under 160 chars), and upload a clean square favicon — these are what make your shared links look credible and get tapped.

Keep custom code minimal and reversible. If you use Custom CSS/JS, change one thing at a time, test on a phone, and remember you can wipe a box and save to undo instantly. Never paste untrusted scripts, and use CRM → Integrations — not Custom JS — for any tracking pixel.

I set a password but the card still opens without asking — why? Almost always it's the inverted switch. The control is "Disable Password Protection": it must be off for the password to apply. If it's on (the default "open" state), the password you typed is cleared on save. Turn the switch off, re-enter the password, and save again.

I forgot my card's password — how do I recover it? You can't read it back, because ScaanMe stores it hashed for security. But you don't need to: just open Advanced Settings, type a brand-new password in the field, and save. The new one immediately replaces the old, and anyone who had the previous password will need the new one.

Does the visitor have to enter the password every single time? No — once they enter it correctly, their browser remembers the unlock for that session, so they can move around the card freely. They may be asked again if they close the browser and return later, or if they open the card on a different device or browser, since the unlock is stored per browser session.

The Advanced Settings page is empty or missing — what's wrong? The page renders only the sections your plan unlocks: the password_protected flag for the password section and the advanced_settings flag for PWA, language switcher, custom code, and SEO. If your plan has neither, ScaanMe skips the page and returns you to your cards list. Upgrade your plan to unlock these controls.

I enabled the language switcher but visitors don't see it — why? Because the switcher only appears when your card has Arabic translations. Enabling the toggle on an English-only card has no visible effect by design, so the option never shows up empty. Add your Arabic content (title, sub-title, fields), then the switcher will appear on the live card.

Where do I add my Facebook/Google tracking pixels? Not here. Marketing and tracking pixels (Meta, GA4, Google Ads, TikTok) live under CRM → Integrations, which is the single owner-scoped place for those per-card IDs. Putting them there — rather than pasting them into Custom JS — keeps visitor-consent handling and CRM attribution working correctly.

Is a password-protected card truly private, or just hidden? Truly gated for the content on the page — none of your card's real details load until the correct password is entered, so it's not a visual blur that can be peeked around. That said, treat it as a strong soft-lock for sharing control, not bank-grade security: anyone you give the password to can pass it on, so use a password you're comfortable circulating among your intended audience.