diff --git a/README.md b/README.md
index 242284c..0a118fe 100644
--- a/README.md
+++ b/README.md
@@ -18,6 +18,8 @@ A more advanced, serverless, and free uptime monitoring & status page solution,
   - Responsive UI that adapts to your system theme
   - Customizable status page
   - Use your own domain with CNAME
+  - Optional password authentication (private status page)
+  - JSON API for fetching realtime status data
 
 ## 👀Demo
 
@@ -44,4 +46,6 @@ Please refer to [Wiki](https://github.com/lyc8503/UptimeFlare/wiki)
 - [ ] SSL certificate checks
 - [ ] Self-host Dockerfile
 - [ ] Incident timeline
+- [ ] Improve `checkLocationWorkerRoute` and fix possible `proxy failed`
+- [ ] Groups 
 - [x] Remove old incidents
diff --git a/middleware.ts b/middleware.ts
new file mode 100644
index 0000000..78ec4d8
--- /dev/null
+++ b/middleware.ts
@@ -0,0 +1,27 @@
+import { NextResponse } from 'next/server'
+import type { NextRequest } from 'next/server'
+import { workerConfig } from './uptime.config'
+ 
+export async function middleware(request: NextRequest) {
+  // @ts-ignore
+  const passwordProtection = workerConfig.passwordProtection
+  if (passwordProtection) {
+    const authHeader = request.headers.get('Authorization')
+    let authenticated = false
+    const expected = 'Basic ' + btoa(passwordProtection)
+
+    if (authHeader && authHeader.length === expected.length) {
+      // a simple timing-safe compare
+      authenticated = true;
+      for (let i = 0; i < authHeader.length; i++) {
+        if (authHeader[i] !== expected[i]) authenticated = false;
+      }
+    }
+
+    if (!authenticated) {
+      return NextResponse.json(
+        { code: 401, message: "Not authenticated" }, { status: 401, headers: { 'WWW-Authenticate': 'Basic' } }
+      )
+    }
+  }
+}
diff --git a/uptime.config.ts b/uptime.config.ts
index 00be288..acddf06 100644
--- a/uptime.config.ts
+++ b/uptime.config.ts
@@ -10,8 +10,10 @@ const pageConfig = {
 }
 
 const workerConfig = {
-  // Write KV at most every 3 minutes unless the status changed.
+  // Write KV at most every 3 minutes unless the status changed
   kvWriteCooldownMinutes: 3,
+  // Enable HTTP Basic auth for status page & API by uncommenting the line below, format `<USERNAME>:<PASSWORD>`
+  // passwordProtection: 'username:password',
   // Define all your monitors here
   monitors: [
     // Example HTTP Monitor