# How to Password Protect a Netlify Site

> Enable Netlify Password Protection, choose production or preview coverage, and test visitor access across deployment URLs and custom domains.

Netlify can require a shared password before serving a site. Basic site-wide password protection is available on Pro; Enterprise includes additional protection options. Check your plan before configuring access. Netlify’s [Password Protection documentation](https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/) lists current eligibility and settings.

## Choose a visitor access method

| Method | Use it for |
|---|---|
| Shared password | A small audience sharing one secret |
| Team login | Visitors who belong to your Netlify team |
| Application authentication | Individual users and application-specific permissions |

Netlify distinguishes these options in its [secure access overview](https://docs.netlify.com/manage/security/secure-access-to-sites/overview/). A password form in your own JavaScript does not provide the same protection: visitors may still retrieve the files behind it.

## Enable a password on credit-based plans

1. Open **Project configuration > General > Visitor access > Project visibility**.
2. Select **Edit visibility**. Override the team default if needed.
3. Choose **Password** and enter your password.
4. Set **Preview access** to cover **Production and previews** or **Previews only**, as appropriate.
5. Save and test the site while signed out.

The password option requires an eligible plan even when the Project visibility settings are visible on your account. Follow the [current dashboard instructions](https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/) if labels differ.

## Enable a password on other plan types

Enterprise, Open Source, and legacy plans use **Visitor access > Password Protection**. Select **Configure**, choose **Basic password protection**, enter a password, choose the deployment scope, and save. Feature availability still depends on the plan.

## Check which deployments are protected

Decide whether the public production site should remain open while previews are restricted, or whether every deployment needs a gate. A team default can affect several projects; an override changes the selected project.

List the URLs you expect recipients to use, including the custom domain, `.netlify.app` address, and deploy previews. Check direct links to downloadable files as well as the homepage. Review any configured bypasses or route-specific authentication rules.

## Test before sharing

1. Open each relevant URL in a private browser window.
2. Confirm that the page requires a password where intended.
3. Try an incorrect password and check that access fails.
4. Enter the correct password and check the page, assets, and downloads.
5. Repeat after changing the password or deployment scope.

Use a fresh browser session for the denied-access test. An existing authenticated session can make an unprotected route harder to notice.

## When visitors need separate accounts

A shared password does not tell you which person used it. If recipients need separate permissions or you need to revoke one person’s access, use identity-based access appropriate to the application. Netlify documents team login, JWT-based role controls, and custom-header Basic Authentication in its [access overview](https://docs.netlify.com/manage/security/secure-access-to-sites/overview/).

Whichever method you choose, remove credentials and internal files from the deployed output. Authorized visitors can download anything the site delivers to their browsers.

Get Email address for your AI agent

Create a cloud bucket and copy its @revdokumail.com email address.

Emails sent to this email are saved as JSON and Markdown, attachments are extracted.

Connect AI agents to read and manage saved emails and files via the API, CLI, MCP, or Skill.

Create Free Account or connect your AI agent

Connect AI:

Prompt
Skill
MCP
API

Show full prompt ⌄

Copy

npx skills add revdoku/revdoku --skill revdoku -g

Copy

Claude Code
Codex
Cursor
Gemini CLI
Hermes Agent
OpenClaw

Codex CLI Claude Code Other AI app

Codex CLI
Claude Code
Other

codex mcp add revdoku --url https://app.revdoku.com/mcp && codex mcp login revdoku Copy

claude mcp add --transport http revdoku https://app.revdoku.com/mcp && claude mcp login revdoku Copy

Transport Streamable HTTP Auth Browser OAuth

https://app.revdoku.com/mcp Copy

Open the MCP setup guide →

JavaScript
Python
C# (.NET)

const apiKey = process.env.REVDOKU_API_KEY; // Get a key at https://app.revdoku.com/account/access
if (!apiKey) throw new Error("Set REVDOKU_API_KEY first");

const response = await fetch(
"https://app.revdoku.com/api/v1/buckets", {
method: "POST",
headers: {
Authorization: `Bearer ${apiKey}`,
"Content-Type": "application/json"
},
body: JSON.stringify({ bucket: { title: "My agent inbox" } })
}
);
if (!response.ok) {
throw new Error(`HTTP ${response.status}: ${await response.text()}`);
}
const { data } = await response.json();
const inbox = data.bucket.inbound_email;
console.log("Bucket ID:", data.bucket.id);
console.log("Email:", inbox.address);
console.log("Ready:", inbox.ready);
console.log("Open:", data.bucket.dashboard_url);
if (!inbox.ready) console.log("Receiving:", inbox.blocked_reason);
Copy code

JavaScript setup & full example →

import os
import requests

api_key = os.environ["REVDOKU_API_KEY"] # Get a key at https://app.revdoku.com/account/access
response = requests.post(
"https://app.revdoku.com/api/v1/buckets",
headers={"Authorization": f"Bearer {api_key}"},
json={"bucket": {"title": "My agent inbox"}},
timeout=30,
)
response.raise_for_status()
bucket = response.json()["data"]["bucket"]
inbox = bucket["inbound_email"]
print("Bucket ID:", bucket["id"])
print("Email:", inbox["address"])
print("Ready:", inbox["ready"])
print("Open:", bucket["dashboard_url"])
if not inbox["ready"]:
print("Receiving:", inbox["blocked_reason"])
Copy code

Python setup & full example →

using System.Net.Http.Headers;
using System.Net.Http.Json;
using System.Text.Json;

var apiKey = Environment.GetEnvironmentVariable("REVDOKU_API_KEY") // Get a key at https://app.revdoku.com/account/access
?? throw new Exception("Set REVDOKU_API_KEY first");
using var client = new HttpClient();
client.DefaultRequestHeaders.Authorization =
new AuthenticationHeaderValue("Bearer", apiKey);
using var response = await client.PostAsJsonAsync(
"https://app.revdoku.com/api/v1/buckets",
new { bucket = new { title = "My agent inbox" } });
response.EnsureSuccessStatusCode();
using var json = JsonDocument.Parse(await response.Content.ReadAsStringAsync());
var bucket = json.RootElement.GetProperty("data").GetProperty("bucket");
var inbox = bucket.GetProperty("inbound_email");
Console.WriteLine($"Bucket ID: {bucket.GetProperty("id").GetString()}");
Console.WriteLine($"Email: {inbox.GetProperty("address").GetString()}");
Console.WriteLine($"Ready: {inbox.GetProperty("ready").GetBoolean()}");
Console.WriteLine($"Open: {bucket.GetProperty("dashboard_url").GetString()}");
if (!inbox.GetProperty("ready").GetBoolean())
Console.WriteLine($"Receiving: {inbox.GetProperty("blocked_reason").GetString()}");
Copy code

C# (.NET) setup & full example →

## Frequently Asked Questions

### Is Netlify Password Protection the same as adding a password form to my website?

No. Netlify’s native feature places a host-level access gate in front of the site, while a JavaScript form usually hides content only in the browser and can be bypassed.

### Why can’t I find Password Protection in my Netlify settings?

Check your plan and permissions. Credit-based plans use Project visibility; other plan types retain Password Protection settings. Basic site-wide password protection requires an eligible Pro or Enterprise plan.

### Does enabling a password protect every Netlify deployment and URL?

Not necessarily. Confirm whether the rule applies at the project or team level, then test production domains, custom domains, deploy previews, and any routes with bypass or header-based rules.

### How should I test a password-protected Netlify site?

Open each relevant URL in a private browser window and try both an incorrect and the correct password. Also verify that unauthenticated visitors cannot reach alternate domains, previews, or routes that should be restricted.

### When should I use JWT roles or Basic Authentication instead?

Use JWT-based access when your application needs individual users, roles, or application-specific authorization. Basic Authentication through custom headers is better suited to controlled technical workflows, but it requires careful handling of credentials, caching, headers, and deployments.

---

[View the canonical page](https://revdoku.com/blog/how-to-password-protect-a-netlify-site/) · [Browse llms.txt](https://revdoku.com/llms.txt)