How to password protect Hugo site / SSG site?

Solution 1:

Since Hugo is a static site generator, you can't do this directly.

However, it can easily be done via the web server engine. So you need to choose a service that supports access to the web server configuration and allows - or has already installed - a plugin such as NGINX auth_request.

There are plenty of low host hosting and VPS solutions that will let you do this.

Solution 2:

Go Hugo will help you generate static pages.
How those pages are served is entirely up to you, meaning Hugo knows nothing about page protection. Only page generation.

That means you need to generate a way for a site to have some form of authentication.

From 2018:

See "How To Password Protect A Hugo Site", which explains how to add a login page to a Hugo site that’s hosted on Bitbucket / Aerobatic, by Jason Gowans in 2017.
Jason mentions:

It uses Aerobatic’s HTTP basic-auth plugin.
You can add the built-in browser dialog version for free, or the pretty login page option with paid plans.

That plugin is now (2018) deprecated, and replaced with the Password protect plugin.
It does support the protection of a sub-directory:

plugins:
  - name: password-protect
    path: /private
    options:
      password: $SITE_PASSWORD

Update 2021: as noted by aretor in the comments, aerobatic will cease its operations on October 31st.
Netlify would be the current alternative.