diff --git a/server.js b/server.js
index 23c5f1b..11cb754 100644
--- a/server.js
+++ b/server.js
@@ -139,7 +139,12 @@ app.ws('/ws/fetch-medium', (ws, req) => {
     command = msg.split(' ')
     if (command.length == 3 && command[0] == 'fetch') {
       const postSlug = command[1]
-      const mediumUrl = command[2]
+      const password = command[2]
+
+      if (password != process.env.SEANCE_PW) {
+        ws.send('error: Something went wrong. Please try again :(')
+        return
+      }
 
       const postMetaFile = `${postSlug}.json`
 
@@ -183,9 +188,15 @@ app.ws('/ws/push-ghost', (ws, req) => {
     console.log(`We got: ${msg}`)
 
     command = msg.split(' ')
-    if (command.length == 2 && command[0] == 'push') {
+    if (command.length == 3 && command[0] == 'push') {
       const postSlug = command[1]
 
+      // check password
+      if (command[2] != process.env.SEANCE_PW) {
+        ws.send('error: Something went wrong. Please try again :(')
+        return
+      }
+
       // Start the Seance session
       seance = new Seance()
 
@@ -207,6 +218,9 @@ app.ws('/ws/push-ghost', (ws, req) => {
         console.info(`"${postSlug}" pushed successfully.`)
         ws.send(`done: ${postSlug}`)
       })
+    } else {
+      ws.send('error: Malformed message')
+      return
     }
 
   })
diff --git a/static/app.js b/static/app.js
index 04cc108..ebb933a 100644
--- a/static/app.js
+++ b/static/app.js
@@ -11,6 +11,7 @@ function mediumFetch(e) {
 
   const postSlug = document.querySelector('[data-post-slug]').dataset.postSlug
   const mediumUrl = document.querySelector('[data-post-mediumurl]').dataset.postMediumurl
+  var password = document.querySelector('input[name=password]').value
   console.log('Fetching ' + postSlug)
   const socketProtocol = (window.location.protocol === 'https:' ? 'wss:' : 'ws:')
   const socketUrl = socketProtocol + '//' + window.location.host + '/ws/fetch-medium/'
@@ -30,7 +31,7 @@ function mediumFetch(e) {
   statusDiv.appendChild(statusText)
 
   socket.onopen = () => {
-    socket.send('fetch ' + postSlug + ' ' + mediumUrl)
+    socket.send('fetch ' + postSlug + ' ' + password)
   }
 
   socket.onmessage = m => {
@@ -43,13 +44,22 @@ function mediumFetch(e) {
 
       statusText.innerHTML = `<b>${command}: </b>${commandData}`
 
-      // if it's done, clean up
-      if (command == 'done') {
+      if (command == 'notification') {
+        addNotification(commandData)
+      } else if (command == 'done' || command == 'error') {
+
+        // if it's an error, say it
+        if (command == 'error') {
+          addNotification(commandData, className='is-danger')
+        } else {
+          // show alert
+          addNotification(`${postSlug} has been fetched successfully. You can now push it to Ghost`, 'is-success')
+        }
+
+        // since it's done, clean up
         // remove statusbar
         statusDiv.removeChild(statusText)
 
-        // show alert
-        addNotification(`${postSlug} has been fetched successfully. You can now push it to Ghost`, 'is-success')
 
         // show buttons, change text and save slug
         for (i=0;i<statusDiv.children.length;i++) {
@@ -61,8 +71,6 @@ function mediumFetch(e) {
           }
           statusDiv.children[i].classList.remove('is-hidden')
         }
-      } else if (command == 'notification') {
-        addNotification(commandData)
       }
 
     } else {
@@ -75,6 +83,7 @@ function ghostPush(e) {
   if(e) { e.preventDefault() }
 
   const postSlug = document.querySelector('[data-post-slug]').dataset.postSlug
+  var password = document.querySelector('input[name=password]').value
   console.log('Pushing ' + postSlug)
   const socketProtocol = (window.location.protocol === 'https:' ? 'wss:' : 'ws:')
   const socketUrl = socketProtocol + '//' + window.location.host + '/ws/push-ghost/'
@@ -94,7 +103,7 @@ function ghostPush(e) {
   statusDiv.appendChild(statusText)
 
   socket.onopen = () => {
-    socket.send('push ' + postSlug)
+    socket.send('push ' + postSlug + ' ' + password)
   }
 
   socket.onmessage = m => {
@@ -108,14 +117,22 @@ function ghostPush(e) {
 
       statusText.innerHTML = `<b>${command}: </b>${commandData}`
 
-      // if it's done, clean up
-      if (command[0] == 'done') {
+      if (command == 'notification') {
+        addNotification(commandData)
+      } else if (command == 'done' || command == 'error') {
+
+        // if it's an error, say it
+        if (command == 'error') {
+          addNotification(commandData, className='is-danger')
+        } else {
+          // show alert
+          addNotification(`${postSlug} has been pushed to Ghost`, 'is-success')
+        }
+
+        // since it's done, clean up
         // remove statusbar
         statusDiv.removeChild(statusText)
 
-        // show alert
-        addNotification(`${postSlug} has been pushed to Ghost`, 'is-success')
-
         // show buttons and change text
         for (i=0;i<statusDiv.children.length;i++) {
           if (statusDiv.children[i].innerText.startsWith('Push')) {
@@ -123,12 +140,6 @@ function ghostPush(e) {
           }
           statusDiv.children[i].classList.remove('is-hidden')
         }
-      } else if (command == 'notification') {
-        var n = document.createElement('div')
-        n.classList.add('notification')
-        n.classList.add('is-warning')
-        n.innerHTML = commandData
-        document.getElementById('notifications').appendChild(n)
       }
 
     } else {
diff --git a/views/fetch-medium.vue b/views/fetch-medium.vue
index 3dcff17..173418e 100644
--- a/views/fetch-medium.vue
+++ b/views/fetch-medium.vue
@@ -40,6 +40,7 @@
           <p v-if="post.subtitle" class="subtitle is-6">{{ post.subtitle }}</p>
           <p>by {{ post.author }}</p>
           <div class="notifications" id="notifications"></div>
+          <input type="password" name="password" placeholder="password" class="input is-primary is-small"/>
         </div>
         <footer class="card-footer" id="statusbar">
           <a :href="post.mediumUrl" v-if="post.mediumUrl" class="card-footer-item">View on Medium</a>