diff --git a/misuzu.php b/misuzu.php
index a11fe6bf..2851bf3e 100644
--- a/misuzu.php
+++ b/misuzu.php
@@ -267,7 +267,9 @@ MIG;
 
     tpl_add_path(__DIR__ . '/templates');
 
-    if ($app->underLockdown()) {
+    $misuzuBypassLockdown = !empty($misuzuBypassLockdown);
+
+    if (!$misuzuBypassLockdown && $app->underLockdown()) {
         http_response_code(503);
         echo tpl_render('auth.lockdown');
         exit;
@@ -294,6 +296,12 @@ MIG;
         }
     }
 
+    if (!$misuzuBypassLockdown && $app->isStagingSite() && !$app->hasActiveSession()) {
+        http_response_code(401);
+        echo tpl_render('auth.private');
+        exit;
+    }
+
     $inManageMode = starts_with($_SERVER['REQUEST_URI'], '/manage');
     $hasManageAccess = perms_check(perms_get_user(MSZ_PERMS_GENERAL, $app->getUserId()), MSZ_PERM_GENERAL_CAN_MANAGE);
     tpl_var('has_manage_access', $hasManageAccess);
diff --git a/public/auth.php b/public/auth.php
index eae17e5c..0b874be5 100644
--- a/public/auth.php
+++ b/public/auth.php
@@ -3,6 +3,10 @@ use Carbon\Carbon;
 use Misuzu\Application;
 use Misuzu\Database;
 
+$isSubmission = !empty($_POST['auth']) && is_array($_POST['auth']);
+$authMode = $isSubmission ? ($_POST['auth']['mode'] ?? '') : ($_GET['m'] ?? 'login');
+$misuzuBypassLockdown = $authMode === 'login' || $authMode === 'get_user';
+
 require_once __DIR__ . '/../misuzu.php';
 
 $usernameValidationErrors = [
@@ -14,9 +18,8 @@ $usernameValidationErrors = [
 ];
 
 $preventRegistration = $app->disableRegistration();
+$isStagingSite = $app->isStagingSite();
 
-$isSubmission = !empty($_POST['auth']) && is_array($_POST['auth']);
-$authMode = $isSubmission ? ($_POST['auth']['mode'] ?? '') : ($_GET['m'] ?? 'login');
 $authUsername = $isSubmission ? ($_POST['auth']['username'] ?? '') : ($_GET['username'] ?? '');
 $authEmail = $isSubmission ? ($_POST['auth']['email'] ?? '') : ($_GET['email'] ?? '');
 $authPassword = $_POST['auth']['password'] ?? '';
@@ -24,6 +27,7 @@ $authVerification = $_POST['auth']['verification'] ?? '';
 
 tpl_vars([
     'prevent_registration' => $preventRegistration,
+    'is_staging_site' => $isStagingSite,
     'auth_mode' => $authMode,
     'auth_username' => $authUsername,
     'auth_email' => $authEmail,
@@ -57,6 +61,11 @@ switch ($authMode) {
             break;
         }
 
+        if ($isStagingSite) {
+            header('Location: /');
+            return;
+        }
+
         $resetUser = (int)($_POST['user'] ?? $_GET['u'] ?? 0);
         $getResetUser = Database::prepare('
             SELECT `user_id`, `username`
@@ -144,7 +153,7 @@ switch ($authMode) {
         break;
 
     case 'forgot':
-        if ($app->hasActiveSession()) {
+        if ($app->hasActiveSession() || $isStagingSite) {
             header('Location: /');
             break;
         }
diff --git a/public/profile.php b/public/profile.php
index 94760b34..543cb0df 100644
--- a/public/profile.php
+++ b/public/profile.php
@@ -1,10 +1,12 @@
 <?php
 use Misuzu\Database;
 
+$mode = (string)($_GET['m'] ?? null);
+$misuzuBypassLockdown = $mode === 'avatar';
+
 require_once __DIR__ . '/../misuzu.php';
 
 $userId = (int)($_GET['u'] ?? 0);
-$mode = (string)($_GET['m'] ?? null);
 
 switch ($mode) {
     case 'avatar':
diff --git a/src/Application.php b/src/Application.php
index 9f7f3a47..9e468161 100644
--- a/src/Application.php
+++ b/src/Application.php
@@ -306,7 +306,14 @@ final class Application
 
     public function disableRegistration(): bool
     {
-        return $this->underLockdown() || boolval($this->config['Auth']['prevent_registration'] ?? false);
+        return $this->underLockdown()
+            || $this->isStagingSite()
+            || boolval($this->config['Auth']['prevent_registration'] ?? false);
+    }
+
+    public function isStagingSite(): bool
+    {
+        return boolval($this->config['Auth']['staging'] ?? false);
     }
 
     public function getLinkedData(): array
diff --git a/templates/auth/auth.twig b/templates/auth/auth.twig
index 0ef7b09b..cfedbe53 100644
--- a/templates/auth/auth.twig
+++ b/templates/auth/auth.twig
@@ -1,126 +1,63 @@
 {% extends 'auth/master.twig' %}
+{% from 'auth/macros.twig' import auth_login %}
 
 {% block content %}
-    <form class="container container--new auth" method="post" action="">
-        <input type="hidden" name="auth[mode]" value="login">
+    {{ auth_login(
+        auth_username|default(''),
+        auth_register_message|default(auth_login_error|default('')),
+        auth_register_message is defined
+    ) }}
 
-        <div class="auth__header">
-            <div class="avatar avatar--new auth__avatar" id="login-avatar"
-                style="background-image:url('/profile.php?u=0&amp;m=avatar');"></div>
-        </div>
+    {% if not prevent_registration %}
+        <form class="container container--new auth" method="post" action="">
+            <input type="hidden" name="auth[mode]" value="register">
+            <div class="container__title">Register</div>
 
-        {% if auth_register_message is defined %}
-            <div class="warning auth__warning auth__warning--welcome">
-                <div class="warning__content">
-                    {{ auth_register_message }}
+            {% if auth_register_error is defined %}
+                <div class="warning auth__warning">
+                    <div class="warning__content">
+                        {{ auth_register_error }}
+                    </div>
                 </div>
+            {% endif %}
+
+            <div class="auth__form">
+                <input class="input__text input__text--new auth__input" type="text"
+                    name="auth[username]" placeholder="Username"
+                    value="{{ auth_username|default('') }}" required>
+
+                <input class="input__text input__text--new auth__input" type="password"
+                    name="auth[password]" placeholder="Password" required>
+
+                <input class="input__text input__text--new auth__input" type="text"
+                    name="auth[email]" placeholder="E-mail"
+                    value="{{ auth_email|default('') }}" required>
+
+                <button class="input__button input__button--new">Sign up</button>
             </div>
-        {% elseif auth_login_error is defined %}
-            <div class="warning auth__warning">
-                <div class="warning__content">
-                    {{ auth_login_error }}
+        </form>
+    {% endif %}
+
+    {% if not is_staging_site %}
+        <form class="container container--new auth" method="post" action="">
+            <input type="hidden" name="auth[mode]" value="forgot">
+            <div class="container__title">Forgot password</div>
+
+            {% if auth_forgot_error is defined %}
+                <div class="warning auth__warning">
+                    <div class="warning__content">
+                        {{ auth_forgot_error }}
+                    </div>
                 </div>
+            {% endif %}
+
+            <div class="auth__form">
+                <input class="input__text input__text--new auth__input" type="text"
+                    name="auth[email]" placeholder="E-mail"
+                    value="{{ auth_email|default('') }}" required>
+
+                <button class="input__button input__button--new">Send reminder</button>
             </div>
-        {% endif %}
-
-        <div class="auth__form">
-            <input class="input__text input__text--new auth__input" type="text"
-                name="auth[username]" placeholder="Username" id="login-username"
-                value="{{ auth_username|default('') }}" required>
-
-            <input class="input__text input__text--new auth__input" type="password"
-                name="auth[password]" placeholder="Password" required>
-
-            <button class="input__button input__button--new">Login</button>
-        </div>
-    </form>
-
-    <form class="container container--new auth" method="post" action="">
-        <input type="hidden" name="auth[mode]" value="register">
-        <div class="container__title">Register</div>
-
-        {% if auth_register_error is defined %}
-            <div class="warning auth__warning">
-                <div class="warning__content">
-                    {{ auth_register_error }}
-                </div>
-            </div>
-        {% endif %}
-
-        <div class="auth__form">
-            <input class="input__text input__text--new auth__input" type="text"
-                name="auth[username]" placeholder="Username"
-                value="{{ auth_username|default('') }}" required>
-
-            <input class="input__text input__text--new auth__input" type="password"
-                name="auth[password]" placeholder="Password" required>
-
-            <input class="input__text input__text--new auth__input" type="text"
-                name="auth[email]" placeholder="E-mail"
-                value="{{ auth_email|default('') }}" required>
-
-            <button class="input__button input__button--new">Sign up</button>
-        </div>
-    </form>
-
-    <form class="container container--new auth" method="post" action="">
-        <input type="hidden" name="auth[mode]" value="forgot">
-        <div class="container__title">Forgot password</div>
-
-        {% if auth_forgot_error is defined %}
-            <div class="warning auth__warning">
-                <div class="warning__content">
-                    {{ auth_forgot_error }}
-                </div>
-            </div>
-        {% endif %}
-
-        <div class="auth__form">
-            <input class="input__text input__text--new auth__input" type="text"
-                name="auth[email]" placeholder="E-mail"
-                value="{{ auth_email|default('') }}" required>
-
-            <button class="input__button input__button--new">Send reminder</button>
-        </div>
-    </form>
-
-    <script>
-        let avatarTimeout = 0;
-
-        function updateLoginAvatar(avatar, username, force) {
-            if (!force) {
-                if (avatarTimeout)
-                    return;
-                console.log(avatarTimeout);
-
-                avatarTimeout = setTimeout(() => {
-                    updateLoginAvatar(avatar, username, true);
-                    clearTimeout(avatarTimeout);
-                    avatarTimeout = 0;
-                }, 750);
-                return;
-            }
-
-            const request = new XMLHttpRequest;
-            request.addEventListener('readystatechange', () => {
-                if (request.readyState !== 4)
-                    return;
-
-                avatar.style.backgroundImage = 'url(\'/profile.php?u=%d&m=avatar\')'.replace('%d', request.responseText);
-            });
-            request.open('GET', '/auth.php?m=get_user&u=' + encodeURI(username.value));
-            request.send();
-        }
-
-        window.addEventListener('load', () => {
-            const avatar = document.getElementById('login-avatar'),
-                username = document.getElementById('login-username');
-
-            updateLoginAvatar(avatar, username, true); // in case there's anything prefilled
-
-            username.addEventListener('keyup', function (ev) {
-                updateLoginAvatar(avatar, username);
-            });
-        });
-    </script>
+        </form>
+    {% endif %}
 {% endblock %}
diff --git a/templates/auth/macros.twig b/templates/auth/macros.twig
new file mode 100644
index 00000000..ac4dfc24
--- /dev/null
+++ b/templates/auth/macros.twig
@@ -0,0 +1,71 @@
+{% macro auth_login(username, message, is_welcome) %} {# please only use this once per page, it has script shit rn #}
+    {% set is_welcome = is_welcome|default(false) %}
+
+    <form class="container container--new auth" method="post" action="/auth.php">
+        <input type="hidden" name="auth[mode]" value="login">
+
+        <div class="auth__header">
+            <div class="avatar avatar--new auth__avatar" id="login-avatar"
+                style="background-image:url('/profile.php?u=0&amp;m=avatar');"></div>
+        </div>
+
+        {% if message|length > 0 %}
+            <div class="warning auth__warning{% if is_welcome %} auth__warning--welcome{% endif %}">
+                <div class="warning__content">
+                    {{ message }}
+                </div>
+            </div>
+        {% endif %}
+
+        <div class="auth__form">
+            <input class="input__text input__text--new auth__input" type="text"
+                name="auth[username]" placeholder="Username" id="login-username"
+                value="{{ username|default('') }}" required>
+
+            <input class="input__text input__text--new auth__input" type="password"
+                name="auth[password]" placeholder="Password" required>
+
+            <button class="input__button input__button--new">Login</button>
+        </div>
+    </form>
+
+    <script>
+        let avatarTimeout = 0;
+
+        function updateLoginAvatar(avatar, username, force) {
+            if (!force) {
+                if (avatarTimeout)
+                    return;
+                console.log(avatarTimeout);
+
+                avatarTimeout = setTimeout(() => {
+                    updateLoginAvatar(avatar, username, true);
+                    clearTimeout(avatarTimeout);
+                    avatarTimeout = 0;
+                }, 750);
+                return;
+            }
+
+            const request = new XMLHttpRequest;
+            request.addEventListener('readystatechange', () => {
+                if (request.readyState !== 4)
+                    return;
+
+                avatar.style.backgroundImage = 'url(\'/profile.php?u=%d&m=avatar\')'.replace('%d', request.responseText);
+            });
+            request.open('GET', '/auth.php?m=get_user&u=' + encodeURI(username.value));
+            request.send();
+        }
+
+        window.addEventListener('load', () => {
+            const avatar = document.getElementById('login-avatar'),
+                username = document.getElementById('login-username');
+
+            updateLoginAvatar(avatar, username, true); // in case there's anything prefilled
+
+            username.addEventListener('keyup', function (ev) {
+                updateLoginAvatar(avatar, username);
+            });
+        });
+    </script>
+{% endmacro %}
diff --git a/templates/auth/private.twig b/templates/auth/private.twig
new file mode 100644
index 00000000..82c8444e
--- /dev/null
+++ b/templates/auth/private.twig
@@ -0,0 +1,10 @@
+{% extends 'auth/master.twig' %}
+{% from 'auth/macros.twig' import auth_login %}
+
+{% block content %}
+    {{ auth_login(
+        auth_username|default(''),
+        auth_login_error|default('You must log in to access the testing site.'),
+        auth_login_error is not defined
+    ) }}
+{% endblock %}