--- title: "How to password-protect a Netlify site or deploy previews | Netlify Knowledge Base" description: "Guides and articles to help you get the most out of the Netlify platform." source: "https://www.netlify.com/knowledge-base/how-to-password-protect-a-netlify-site-or-deploy-previews/" last_updated: "2026-09-23T19:52:09.000Z" --- ## Key takeaways On credit-based plans, go to **Project configuration > General > Visitor access > Project visibility** and choose **Password** (shared password, Pro only) or **Private** (team and invitees, enforced with Netlify login). Then pick a scope: **Production and previews**, or **Previews only**. On Enterprise, Open Source, and legacy plans the same mechanism is called **Password Protection** and lives under Access & security. - **These settings have no public API, no CLI command, and no MCP tool.** The dashboard is the only surface. - **Private is usually the better answer than Password.** It lets you invite by email and needs no shared secret. - **Previews stay private by default**, including Deploy Previews, agent-run previews, and branch deploys. - **Private projects can’t receive third-party webhooks.** Slack, Stripe, and the rest need a public project. - **Team login excludes Git Contributors**, and every employee who passes it needs a paid Netlify seat. - **Firewall rules run before any login prompt**, so a blocked IP sees an error page instead. ## Three different things called “auth” Before changing any setting, it’s worth knowing which of three unrelated layers you actually want, because they get conflated constantly and the sessions are entirely separate. **Password Protection and project visibility** answer “can this request load the site at all.” That’s the platform perimeter, and it’s what this article covers. **Netlify Identity** answers “who is this user _inside_ my app.” App login, OAuth providers for your users, roles. See How to add user login to a Netlify site with Identity. **Team and Org SAML SSO** answers “can you log into the Netlify dashboard.” That’s team member access to Netlify itself. If you’re not sure which you need, Netlify auth: site protection, app login, or team SSO? walks through it properly. One thing worth noting now: the same provider, say Google, can be an Identity OAuth provider for your app users _and_ a SAML IdP for your team members. Those are unrelated pieces of wiring. ## Pick the layer Goal Use Restrict site to your team, invite by email Private project (credit-based) or team login protection Shared password anyone can use Basic password protection, or Password visibility (Pro only) Protect only previews, keep production open ”Non-production deploys only” / “Previews only” Require SSO to view the site Org/Team SSO with **Only SSO allowed (strict)** plus team login protection Log in users _inside_ your app Netlify Identity Single company-wide app SSO, no double login The Auth0 extension That last row matters more than it looks. If what you want is company-wide app-level SSO with a **single** sign-in, reach for the **Auth0 extension** federating to your corporate IdP, _before_ stacking a perimeter on top of Identity. The reason is in the failure modes below. ## Worked example ### Setting a password (credit-based, Pro) 1. Go to the project, then **Project configuration > General > Visitor access > Project visibility**. 2. Click **Edit visibility**. If a team default is set, choose **Customize this project’s visibility** to override it. 3. Select **Password** and enter the password. You share it with visitors yourself; there’s no default. 4. Choose **Preview access**: **Production and previews**, or **Previews only**. 5. **Save.** Later you can use **Change password**, or remove protection by choosing **Public** or **Private**. ### Password Protection (Enterprise, Open Source, legacy) Go to the per-site or team-default path, then **Configure Password Protection**. If a team default exists, choose **Customize this site’s protection settings**. Then pick: - **Basic password protection**: a single shared password. - **Team login protection**: Netlify team login, SSO-capable. Scope it to **All deploys** or **Non-production deploys only**, and **Save**. ### Requiring SSO to view a site 1. **First** set up [Organization SSO](https://docs.netlify.com/manage/security/secure-netlify-access/configure-organization-saml-sso) or [Team SSO](https://docs.netlify.com/manage/security/secure-netlify-access/configure-team-saml-sso). 2. Configure Password Protection and choose **Team login protection**. 3. To force SSO rather than allow it, set the SSO config to **Only SSO allowed (strict)**. ### Dashboard paths **Credit-based (Project visibility):** - Per-project: Project configuration > General > Visitor access > Project visibility - Team default: Team settings > General > Visitor access > Default project visibility **Enterprise, Open Source, legacy (Password Protection):** - Per-site: Project configuration > Access & security > Visitor access > Password Protection - Team default: Team settings > Access & security > Visitor access > Default Password Protection settings ### Handling SSO session expiry SSO auth tokens **expire after 1 hour**, at which point an SSO-protected site starts returning `401`. That’s the “logged out mid-session” symptom. The platform returns a `Netlify-Site-Protection-Expires-In` response header giving seconds until expiry. Read it and re-authenticate before it reaches zero: ``` // SSO-protected site: refresh before the 1-hour token expires to avoid a 401.const res = await fetch(window.location.href, { credentials: "include" });const secondsLeft = Number(res.headers.get("Netlify-Site-Protection-Expires-In"));if (!Number.isNaN(secondsLeft) && secondsLeft < 60) { window.location.reload(); // triggers re-auth via the identity provider} ``` The header name and semantics are documented. The JavaScript above is one illustrative way to use it. ## Common failure modes **You went looking for the API and couldn’t find it.** There isn’t one. These settings have **no public API, no CLI command, and no MCP tool.** The dashboard is the only way to inspect or change them. **Users are logged out mid-session, or your SSO-protected site returns 401s.** SSO tokens expire after an hour. Read `Netlify-Site-Protection-Expires-In` and re-auth before expiry. **You stacked a perimeter on top of Identity and now users log in twice.** That’s real and it can’t be wired away. A Password-Protection or team-login perimeter session and a Netlify Identity app session have **no bridge**: no shared cookie, no forwarded header, no JWT exchange. A perimeter session also represents _team-member_ identity rather than an app end-user record with roles, so even a hypothetical bridge wouldn’t cleanly become your app’s user. Don’t spend iterations on it. If single sign-on matters, use invite-only Identity or the Auth0 extension instead. **Your team-login perimeter is costing more than expected.** Team login admits only Netlify team members, so **every employee who passes it needs a paid Netlify seat.** That’s the hidden cost of the genuine two-layer setup. **Git Contributors can’t reach the protected deploy.** Team login **excludes Git Contributors** by design. It applies to Developers, Team Owners, and Billing Admins; Reviewers can be invited without limit. **Your team members keep getting prompted for the password.** **Basic password protection prompts everyone**, managing team members included. Use Private or team login if that’s not what you want. **Your Slack or Stripe webhooks stopped arriving.** **Private projects can’t receive third-party webhooks.** Receiving webhooks requires the project to be public. **A visitor sees an error page instead of a login prompt.** Access order puts Advanced Web Security first: firewall rules, WAF, then rate limiting all run **before** any password or login prompt. A blocked IP never reaches the prompt. **“Make public” is greyed out.** Making a project public requires at least one successful production deploy. Also note Internal Builders can’t publish to production, so they can’t make a project public. **You can’t invite anyone.** Free and Personal are single-seat; upgrade to Pro to invite. On Free and Personal, a private project is visible only to the Team Owner. **A new project came out private when you expected public, or vice versa.** Team defaults changed by creation date: teams created **on or after July 28, 2026** default to **Private for new projects**, and teams created before that default to **Public**. **You’re looking for a setting under an old name.** “Site-wide password protection” is now part of **Password Protection**. “Selective password protection” was the old name for [Basic authentication with custom HTTP headers](https://docs.netlify.com/manage/security/secure-access-to-sites/basic-authentication-with-custom-http-headers), which is code you author rather than a platform setting. ## Reference ### Project visibility values (credit-based) One visibility setting plus a separate scope. Visibility Who can load the site **Public** Anyone with the URL **Private** Team and invitees only, enforced with Netlify login. Invite by email, no password needed. **Recommended for restricting to your team.** **Password** Public but requires a shared password. **Pro only** among credit-based plans. Scope: **Production and previews**, or **Previews only**. Previews stay private unless you change preview visibility, and that includes Deploy Previews, agent-run previews, and branch deploys. There is **no** default shared password; set one per project. ### UI naming by plan Same mechanism, different labels. Plan Per-project setting Team-level setting Credit-based Free / Personal / Pro **Project visibility** **Default project visibility** Enterprise / Open Source / legacy **Password Protection** **Default Password Protection settings** ### Legacy to credit-based translation Password Protection (old) Project visibility (new) No protection settings Public Basic protection Password Team protection Private All deploys Production and previews Non-production deploys only Previews only ### Team defaults Default Effect Private for new projects New projects start behind team login; existing keep their visibility Private for all projects New and all existing locked to team login; none can be made public Public for new projects New projects are public; existing keep their visibility ### Plan gating Feature Plans Basic password (whole site) Pro and Enterprise All options including team login Enterprise Project visibility Credit-based Free / Personal / Pro only Private project visibility scope Free and Personal: Team Owner only. Pro: unlimited members. Enterprise / OSS / legacy No project visibility, so use team login protection Protecting only non-production deploys (Password Protection path) **Enterprise only** Invites Free and Personal are single-seat. Pro invites unlimited members to one project or the whole team. ### Who can change these Setting Who Password Protection (per-site) Developer Password Protection (team default) Team Owner Project visibility Org Owners on certain Enterprise plans, Team Owners, Developers with project access ### Access order Advanced Web Security runs first: firewall rules, then WAF, then rate limiting. Only after those does any password or login prompt appear. ### The four ways to combine a perimeter with per-user identity Ordered from least to most friction. Option Logins Plans When **A. Invite-only Netlify Identity** One All (free) Best default for “just my team.” Identity is both perimeter and in-app identity. Manual invite management; doesn’t scale to thousands. **B. Auth0 extension** One (federated SSO) Auth0 extension, enterprise-oriented Best for a real org with an existing IdP (Okta, Entra, Google Workspace). Supports auto-provisioning. **C. Basic Password Protection + Identity** Two, but the first is a shared secret Pro+ for the gate ”Keep the public out while we build” plus real user accounts. The password is easily forwarded, so treat it as a soft gate. **D. Enterprise team-login perimeter + Identity** **Two** Enterprise Only when a true CDN-edge perimeter is a hard requirement and the double login is acceptable. Every employee needs a paid Netlify seat. One note on unofficial workarounds: a `netlify/netlify-plugin-identity-sso` repo once attempted to bridge the two sessions. It’s unofficial, dormant since 2021, and hardcoded for `@netlify.com` emails. Don’t build on it. ## FAQs **How do I password protect a Netlify site?** On credit-based plans, go to Project configuration > General > Visitor access > Project visibility, choose **Password** (Pro only), enter a password, and pick whether it covers production and previews or previews only. On Enterprise and legacy plans, use Password Protection under Access & security. **Is there an API or CLI command for Netlify password protection?** No. These settings have no public API, no CLI command, and no MCP tool. The dashboard is the only surface. **How do I protect only my deploy previews and leave production public?** Set the scope to **Previews only** (credit-based) or **Non-production deploys only** (Password Protection). Note that for the Password Protection path, protecting only non-production deploys is Enterprise-only. **What’s the difference between Private and Password?** Private restricts the site to your team and invitees, enforced with Netlify login, and lets you invite by email with no shared secret. Password makes the site publicly reachable but gated by one shared password, and it’s Pro-only among credit-based plans. **Are my deploy previews public by default?** No. Previews stay private unless you change preview visibility. That covers Deploy Previews, agent-run previews, and branch deploys. **Why do users have to log in twice?** Because a perimeter session (Password Protection or team login) and a Netlify Identity app session are independent, with no shared cookie or token exchange. If you need a single sign-in, use invite-only Identity or the Auth0 extension rather than stacking layers. **Why is my SSO-protected site returning 401 after a while?** SSO auth tokens expire after 1 hour. Read the `Netlify-Site-Protection-Expires-In` response header and re-authenticate before it reaches zero. **Why aren’t my webhooks arriving?** Private projects can’t receive third-party webhooks. The project has to be public to receive them. **Can Git Contributors access a team-login-protected site?** No. Team login excludes Git Contributors. It applies to Developers, Team Owners, and Billing Admins, and Reviewers can be invited. **How do I require SSO to view a site?** Set up Organization or Team SAML SSO first, then configure Password Protection with **Team login protection**, and set the SSO config to **Only SSO allowed (strict)** to force it. ## Related - [Configure Team SAML SSO](https://docs.netlify.com/manage/security/secure-netlify-access/configure-team-saml-sso) - [Configure Organization SAML SSO](https://docs.netlify.com/manage/security/secure-netlify-access/configure-organization-saml-sso) - [Basic authentication with custom HTTP headers](https://docs.netlify.com/manage/security/secure-access-to-sites/basic-authentication-with-custom-http-headers) This article is generated from Netlify’s open-source agent guidance at [netlify/context-and-tools](https://github.com/netlify/context-and-tools), the same reference our AI coding agents use. * * * Need to lock something down? Start at [netlify.new](https://netlify.new).