diff --git a/src/Auth/Protect/Protectors/Password/Controller.php b/src/Auth/Protect/Protectors/Password/Controller.php
index 3e0a890f186..c92ad9efcf6 100644
--- a/src/Auth/Protect/Protectors/Password/Controller.php
+++ b/src/Auth/Protect/Protectors/Password/Controller.php
@@ -19,7 +19,7 @@ class Controller extends BaseController
     public function show()
     {
         if ($this->tokenData = session('statamic:protect:password.tokens.'.request('token'))) {
-            $site = Site::findByUrl($this->getUrl());
+            $site = Site::findByUrl($this->getUrl()) ?? Site::default();
             $data = Data::find($this->tokenData['reference']);
 
             app()->setLocale($site->lang());
diff --git a/tests/Auth/Protect/PasswordProtectionTest.php b/tests/Auth/Protect/PasswordProtectionTest.php
index 1efda28c8cf..e769eb01c94 100644
--- a/tests/Auth/Protect/PasswordProtectionTest.php
+++ b/tests/Auth/Protect/PasswordProtectionTest.php
@@ -108,6 +108,35 @@ public function default_password_form_url_is_unprotected()
             ->assertOk();
     }
 
+    #[Test]
+    public function password_form_falls_back_to_default_site_when_url_doesnt_match_a_site()
+    {
+        $this->viewShouldReturnRendered('statamic::auth.protect.password', '');
+
+        $this->setSites([
+            'en' => ['name' => 'EN', 'locale' => 'en_US', 'lang' => 'en', 'url' => 'http://localhost/en/'],
+            'fr' => ['name' => 'FR', 'locale' => 'fr_FR', 'lang' => 'fr', 'url' => 'http://localhost/fr/'],
+        ]);
+
+        config(['statamic.protect.default' => 'password-scheme']);
+        config(['statamic.protect.schemes.password-scheme' => [
+            'driver' => 'password',
+            'allowed' => ['test'],
+        ]]);
+
+        Token::shouldReceive('generate')->andReturn('test-token');
+
+        $this
+            ->get('/')
+            ->assertRedirect('http://localhost/!/protect/password?token=test-token');
+
+        $this
+            ->get('/!/protect/password?token=test-token')
+            ->assertOk();
+
+        $this->assertEquals('en', app()->getLocale());
+    }
+
     #[Test]
     public function custom_password_form_url_is_unprotected()
     {