How to Password Protect a ChatGPT Site
TL;DR: A public ChatGPT Site does not support a simple shared password. Protection is limited to Only you, workspace or selected-user access on supported accounts, Anyone with the link, and public publishing. For a client password gate, export or copy the site files and publish them through a host with access control.
Does ChatGPT Sites password protection include a shared password?
| Option | Native availability | Best use |
|---|---|---|
| Only you | Yes | Drafts and private work |
| Selected users or workspace | Account-dependent | Internal collaboration |
| Anyone with the link | Yes | Non-sensitive previews |
| Public internet | When public publishing is enabled | Work meant to be discovered |
| Shared password | No simple native option | Use protected hosting |
“Anyone with the link” is not private. The URL acts like a bearer token: recipients may be able to open and forward it. A long, random-looking address is not authentication.
Public Sites can appear in search results. Our Google indexing test of ChatGPT Sites found multiple pages under chatgpt.site. Use public publishing only for material you are comfortable showing to anyone.
How to make a ChatGPT site private
Labels vary by account and workspace; the steps are:
- Open ChatGPT and go to your Sites list.
- Open the Site you want to review.
- Select Share.
- Change Who has access to Only you, selected users, or the narrowest workspace setting available.
- If the Site should no longer exist, open its settings and delete it.
- Test the old URL in a private browser window.
OpenAI’s ChatGPT Sites help explains the available sharing modes. Because Sites is evolving and workspace administrators may limit choices, check the current dialog.
Restricting or deleting a Site stops future access at the source but cannot recall screenshots, downloads, search snippets, or saved copies.
How to password protect a ChatGPT site with a real password gate
For an external client, secure a ChatGPT site by publishing its browser-ready output separately:
- Export or copy the HTML, CSS, JavaScript, images, and downloads that make up the Site.
- Remove API keys, private prompts, customer data, and any file that should not ship.
- Put the finished folder in Revdoku.
- Choose Password or Verified email access.
- Add allowed email addresses or domains if the audience must be named.
- Open the new URL while signed out and confirm the gate appears before any content loads.
Revdoku publishes the export; it does not password-protect the original chatgpt.site address.
A protected Revdoku link also provides visitor notifications; page-view, click, and download activity; and file replacement without a new URL. This lets a client receive several revisions at one stable link.
For a compact feature comparison, see ChatGPT Sites vs Revdoku.
Secure a ChatGPT site without fake password protection
Do not use a JavaScript prompt that hides an already-loaded page. Visitors may still retrieve the HTML, assets, and password logic. Real protection checks access before serving protected files.
Bottom line on ChatGPT Sites password protection
Use native audience settings for private drafts, internal collaboration, or public work. For client sites needing a shared password, verified-email login, approved-viewer controls, and activity tracking, publish the exported site through Revdoku and share its protected URL.
Frequently asked questions
Can I add a shared password directly to a ChatGPT Site?
No. ChatGPT Sites supports audience-based sharing options, but it does not provide a simple shared-password gate for public or link-accessible sites. Use a separate host with server-side access control when a client needs password-protected access.
Is “Anyone with the link” suitable for confidential content?
No. Anyone who receives or is forwarded the URL may be able to access the Site. Use this option only for non-sensitive previews you are comfortable having redistributed.
How can I restrict access to an existing ChatGPT Site?
Open the Site’s sharing settings and select the narrowest available option, such as “Only you,” selected users, or workspace access. Then test the old URL in a private browser window to confirm that anonymous access is blocked.
Can changing the sharing settings remove copies people already saved?
No. Restricting or deleting the Site prevents future access at the source, but it cannot erase screenshots, downloads, cached results, search snippets, or other saved copies. Avoid publishing sensitive material in the first place.
How do I create a real password gate for a client?
Export or copy the Site’s browser-ready files and publish them through a host that checks credentials before serving the content. Remove API keys, private prompts, customer information, and other secrets before uploading, then verify the gate while signed out.
Why is a JavaScript password prompt not secure?
A client-side prompt may only conceal content that has already been downloaded by the browser. Visitors can often inspect the page source, assets, and password-checking logic, so real protection must happen before protected files are delivered.
Does protecting an exported copy also protect the original ChatGPT Site?
No. Access controls on another hosting service apply only to the newly published copy. Restrict or delete the original chatgpt.site version separately and share only the protected replacement URL.
History
- August 2, 2026 — Published by Revdoku Content Team
- August 1, 2026 — Reviewed by Eugene Mi
- August 1, 2026 — Last updated by Revdoku Content Team.
Related Articles
GitHub Pages Password Protection and Privacy
Learn why private repositories do not protect Pages sites and compare secure access options for internal teams and external clients.
How to Password Protect a Vercel Deployment
Learn how to secure Vercel deployments with password protection, authentication, trusted access, or protected Revdoku hosting.
How to Password Protect a Website Made with Claude
Learn how to export, secure, publish, and test a Claude-made website using password protection or verified-email access.