Searching for a secure photo gallery usually means one of two worries: that patient photos on a public page are a privacy problem, or that the files themselves give something away. On 27 October 2026 we checked every med spa website in our 393-site study for a before-and-after page. 162 publish one, and all 162 opened for us with no password, no login and nothing telling Google to stay out. That unanimity is not carelessness. The real exposure sits somewhere else, and a password on the page would not close it.
The short answer
For most clinics, no. If you hold a signed marketing authorization for every photo you publish, a public gallery is both lawful and the version that books patients. Gating it protects nothing the authorization does not already cover, and it hides the page people use to decide whether you can do the thing they want done.
Two things do deserve attention, and a page password solves neither: where the image files live, and what is still inside them.
What 162 med spa galleries actually do
We re-checked the 393 med spa websites graded in our September 2026 study. For each site we requested the sitemap at the standard locations, collected every URL containing before-and-after, gallery, results or transformations, then requested the first one as an ordinary anonymous visitor and read what came back. The scan ran on 27 October 2026.
- 346 of 393 sites published a sitemap we could read. The other 47 either had none at a standard path or blocked our request.
- 162 of those 346 (47%) list at least one gallery page, 400 URLs between them. 76 sites list more than one, usually a separate gallery per treatment.
- 160 of the 162 returned the page to an anonymous request. Two returned an error.
- None asked for a password. Checking the page source for a real password field, rather than the word appearing in a stylesheet, found zero across all 162.
- None carried a noindex tag. Every one of these galleries is open to Google as well as to patients.
- On naming, 227 of the 400 URLs used some form of before-and-after and 156 used gallery. Results, photo-gallery and transformations accounted for the remaining 17.
The practice is unanimous, and it is the right default. The gallery is usually the highest-intent page on a med spa site, and our before-and-after gallery guide covers how to structure one so it converts. A gate in front of it costs bookings from exactly the visitors who were closest to making one.
A password on the page is not a lock on the photos
Page-level protection, whether that is the password field built into WordPress or the equivalent in Squarespace, Wix and Showit, gates the rendered page. The images keep their own URLs on the same server or content delivery network. As Delicious Brains puts it in their guide to protecting WordPress media, the default setup makes every uploaded file publicly accessible via a direct URL.
What that means for a gallery you decide to gate later:
- Anyone who saw the page while it was public has the image addresses in their browser history and cache.
- Google may already hold the images from before the gate went up. Restricting a page does not remove the files it linked to.
- Several platforms publish image entries in the sitemap separately from the page, so the files stay listed after the page is hidden.
- Copies already downloaded are gone from your control entirely.
What we found inside the photo files
The warning you will read elsewhere is that patient photos carry GPS coordinates from the phone that took them. We tested it. On 90 of the gallery pages we could read at least one JPEG directly, 226 images in total.
- 84 of the 226 images (37%) still carried an EXIF metadata block of some kind.
- 21 images still had the original capture date and time.
- 5 sites had at least one image with the camera's make and model embedded.
- None of the 226 carried GPS coordinates. Not one.
Zero is the number worth keeping. Phone cameras do record location, but the upload and resize step that every mainstream platform runs strips it before publication. What survives is a capture date and occasionally a camera model, neither of which identifies a patient. One honest limit on this: the other 69 gallery pages delivered their images through JavaScript, WebP or lazy-loading attributes our reader did not follow, so this is 226 files from 90 clinics, not a clean bill of health for the whole industry.
When a gated gallery is the right call
Three situations genuinely call for something other than an open page, and only one of them is a password.
- The patient agreed to in-clinic use, not publication. Then the photo does not belong on the website at all, gated or otherwise. A password is not a substitute for the authorization, and publishing behind one does not change what was authorized.
- Intimate-area or full-body results. Where the patient has authorized publication but the image is not something every visitor should meet by scrolling, a click-to-reveal panel on the page is reasonable. That is a courtesy to your other visitors, and it keeps the page itself indexable.
- A referring-provider view. Showing clinical outcomes to colleagues rather than prospects is a different audience and a different page. Gate that one properly, at the file level, and keep it out of the sitemap.
Outside those three, an open gallery is the version that works. The legal question is settled before the page is built, not by the page's settings, and our breakdown of the consent rules for before-and-after photos covers what the authorization has to say.
How to protect the parts that matter
- Publish only what you hold written marketing authorization for. This is the whole of the privacy question. Everything below is housekeeping.
- Keep a log of where each image is published so that a withdrawal request can actually be honoured across the site, social profiles and any ad creative.
- Name files for the treatment, not the patient. Use something like botox-glabella-3-weeks.jpg and never jsmith-after.jpg. The filename becomes part of a public URL that outlives the page.
- Strip metadata before upload if you want certainty rather than trust in the platform. Most phone gallery apps offer a remove-location option when sharing.
- Keep page-level analytics and ad pixels off treatment-specific gallery URLs. A page view tied to an identifiable visitor on a page named for one procedure is the risk our HIPAA guide calls the tracking-pixel trap, and it is a far more realistic exposure than metadata.
- If you do gate, gate the files. Move them out of the public uploads path and serve them through signed or expiring URLs. Password-protecting the page alone gives you the inconvenience without the protection.
Where to start
Open your own gallery in a private browser window, right-click one of the photos, copy its address and paste it into a fresh tab. Whatever loads there is what the public can reach, regardless of what the page in front of it does. Then download that same file and look at its location field. Those two checks take five minutes and tell you more than any setting in your site builder. Run the rest of your site through the free grader for a 30-second read on the basics, or request a free audit and we will email you the top fixes, no call needed.