How to Password Protect a Netlify Site
Netlify can require a shared password before serving a site. Basic site-wide password protection is available on Pro; Enterprise includes additional protection options. Check your plan before configuring access. Netlify’s Password Protection documentation lists current eligibility and settings.
Choose a visitor access method
| Method | Use it for |
|---|---|
| Shared password | A small audience sharing one secret |
| Team login | Visitors who belong to your Netlify team |
| Application authentication | Individual users and application-specific permissions |
Netlify distinguishes these options in its secure access overview. A password form in your own JavaScript does not provide the same protection: visitors may still retrieve the files behind it.
Enable a password on credit-based plans
- Open Project configuration > General > Visitor access > Project visibility.
- Select Edit visibility. Override the team default if needed.
- Choose Password and enter your password.
- Set Preview access to cover Production and previews or Previews only, as appropriate.
- Save and test the site while signed out.
The password option requires an eligible plan even when the Project visibility settings are visible on your account. Follow the current dashboard instructions if labels differ.
Enable a password on other plan types
Enterprise, Open Source, and legacy plans use Visitor access > Password Protection. Select Configure, choose Basic password protection, enter a password, choose the deployment scope, and save. Feature availability still depends on the plan.
Check which deployments are protected
Decide whether the public production site should remain open while previews are restricted, or whether every deployment needs a gate. A team default can affect several projects; an override changes the selected project.
List the URLs you expect recipients to use, including the custom domain, .netlify.app address, and deploy previews. Check direct links to downloadable files as well as the homepage. Review any configured bypasses or route-specific authentication rules.
Test before sharing
- Open each relevant URL in a private browser window.
- Confirm that the page requires a password where intended.
- Try an incorrect password and check that access fails.
- Enter the correct password and check the page, assets, and downloads.
- Repeat after changing the password or deployment scope.
Use a fresh browser session for the denied-access test. An existing authenticated session can make an unprotected route harder to notice.
When visitors need separate accounts
A shared password does not tell you which person used it. If recipients need separate permissions or you need to revoke one person’s access, use identity-based access appropriate to the application. Netlify documents team login, JWT-based role controls, and custom-header Basic Authentication in its access overview.
Whichever method you choose, remove credentials and internal files from the deployed output. Authorized visitors can download anything the site delivers to their browsers.
A docs portal with Ask AI
and support tickets
Connect a repository, or describe your product to start. Each docs site has search, Ask AI, an API console, an MCP server and support tickets.
- Publishes from GitHub on every push
- Works with Mintlify repositories
- API console from your OpenAPI file
- MCP server and llms.txt for AI agents
- Ask AI and support tickets
- Analytics for people and AI agents
Frequently Asked Questions
Is Netlify Password Protection the same as adding a password form to my website?
No. Netlify’s native feature places a host-level access gate in front of the site, while a JavaScript form usually hides content only in the browser and can be bypassed.
Why can’t I find Password Protection in my Netlify settings?
Check your plan and permissions. Credit-based plans use Project visibility; other plan types retain Password Protection settings. Basic site-wide password protection requires an eligible Pro or Enterprise plan.
Does enabling a password protect every Netlify deployment and URL?
Not necessarily. Confirm whether the rule applies at the project or team level, then test production domains, custom domains, deploy previews, and any routes with bypass or header-based rules.
How should I test a password-protected Netlify site?
Open each relevant URL in a private browser window and try both an incorrect and the correct password. Also verify that unauthenticated visitors cannot reach alternate domains, previews, or routes that should be restricted.
When should I use JWT roles or Basic Authentication instead?
Use JWT-based access when your application needs individual users, roles, or application-specific authorization. Basic Authentication through custom headers is better suited to controlled technical workflows, but it requires careful handling of credentials, caching, headers, and deployments.
History
- August 10, 2026 — Published by Revdoku Content Team
- August 1, 2026 — Reviewed by Eugene Mi
- September 24, 2026 — Last updated by Revdoku Content Team.
Related Articles
Move Exported Grok Website Files to Another Host
Export a Grok Build site to GitHub, deploy it on Cloudflare Pages, Netlify, Vercel or GitHub Pages, test it, then retire the grok.me copy.
Move Exported Claude Artifacts to Another Host
Move a Claude Artifact to Cloudflare Pages, Netlify or GitHub Pages: get the code, build React artifacts, replace Claude-only features, then unpublish.
Move a ChatGPT Site to Another Host
ChatGPT Sites has no documented export. Get the source, and replace storage and sign-in. Test a copy on Cloudflare Pages or Netlify before you switch.