How to Password Protect a Netlify Site

Written & reviewed by Updated
Table of Contents

Netlify can require a shared password before serving a site. Basic site-wide password protection is available on Pro; Enterprise includes additional protection options. Check your plan before configuring access. Netlify’s Password Protection documentation lists current eligibility and settings.

Choose a visitor access method

Method Use it for
Shared password A small audience sharing one secret
Team login Visitors who belong to your Netlify team
Application authentication Individual users and application-specific permissions

Netlify distinguishes these options in its secure access overview. A password form in your own JavaScript does not provide the same protection: visitors may still retrieve the files behind it.

Enable a password on credit-based plans

  1. Open Project configuration > General > Visitor access > Project visibility.
  2. Select Edit visibility. Override the team default if needed.
  3. Choose Password and enter your password.
  4. Set Preview access to cover Production and previews or Previews only, as appropriate.
  5. Save and test the site while signed out.

The password option requires an eligible plan even when the Project visibility settings are visible on your account. Follow the current dashboard instructions if labels differ.

Enable a password on other plan types

Enterprise, Open Source, and legacy plans use Visitor access > Password Protection. Select Configure, choose Basic password protection, enter a password, choose the deployment scope, and save. Feature availability still depends on the plan.

Check which deployments are protected

Decide whether the public production site should remain open while previews are restricted, or whether every deployment needs a gate. A team default can affect several projects; an override changes the selected project.

List the URLs you expect recipients to use, including the custom domain, .netlify.app address, and deploy previews. Check direct links to downloadable files as well as the homepage. Review any configured bypasses or route-specific authentication rules.

Test before sharing

  1. Open each relevant URL in a private browser window.
  2. Confirm that the page requires a password where intended.
  3. Try an incorrect password and check that access fails.
  4. Enter the correct password and check the page, assets, and downloads.
  5. Repeat after changing the password or deployment scope.

Use a fresh browser session for the denied-access test. An existing authenticated session can make an unprotected route harder to notice.

When visitors need separate accounts

A shared password does not tell you which person used it. If recipients need separate permissions or you need to revoke one person’s access, use identity-based access appropriate to the application. Netlify documents team login, JWT-based role controls, and custom-header Basic Authentication in its access overview.

Whichever method you choose, remove credentials and internal files from the deployed output. Authorized visitors can download anything the site delivers to their browsers.

Get Email address for your AI agent

  1. Create a cloud bucket and copy its <unique.id>@revdokumail.com email address.
  2. Emails sent to this email are saved as JSON and Markdown, attachments are extracted.
  3. Connect AI agents to read and manage saved emails and files via the API, CLI, MCP, or Skill.
or connect your AI agent
Connect AI:

Frequently Asked Questions

Is Netlify Password Protection the same as adding a password form to my website?

No. Netlify’s native feature places a host-level access gate in front of the site, while a JavaScript form usually hides content only in the browser and can be bypassed.

Why can’t I find Password Protection in my Netlify settings?

Check your plan and permissions. Credit-based plans use Project visibility; other plan types retain Password Protection settings. Basic site-wide password protection requires an eligible Pro or Enterprise plan.

Does enabling a password protect every Netlify deployment and URL?

Not necessarily. Confirm whether the rule applies at the project or team level, then test production domains, custom domains, deploy previews, and any routes with bypass or header-based rules.

How should I test a password-protected Netlify site?

Open each relevant URL in a private browser window and try both an incorrect and the correct password. Also verify that unauthenticated visitors cannot reach alternate domains, previews, or routes that should be restricted.

When should I use JWT roles or Basic Authentication instead?

Use JWT-based access when your application needs individual users, roles, or application-specific authorization. Basic Authentication through custom headers is better suited to controlled technical workflows, but it requires careful handling of credentials, caching, headers, and deployments.

Share:
Markdown version
#Netlify#password protection#visitor access#private site

History

  • August 10, 2026 — Published by Revdoku Content Team
  • August 1, 2026 — Reviewed by Eugene Mi
  • September 24, 2026 — Last updated by Revdoku Content Team.

Related Articles

↧
Loading PDF…