I did as you wrote but, an external visitor asks for the password and me who is logged in opens the site in the squarespace back end, I also saw that the links of the templates for sale are scattered, they look like subdomains ... example
https://leon-template.squarespace.com/?password=demo