How to password-protect a Netlify site or deploy previews
Set project visibility to Password or Private, or use Password Protection on legacy plans. The dashboard paths, the plan gating, and why there's no API for any of it.
Key takeaways
On credit-based plans, go to Project configuration > General > Visitor access > Project visibility and choose Password (shared password, Pro only) or Private (team and invitees, enforced with Netlify login). Then pick a scope: Production and previews, or Previews only. On Enterprise, Open Source, and legacy plans the same mechanism is called Password Protection and lives under Access & security.
- These settings have no public API, no CLI command, and no MCP tool. The dashboard is the only surface.
- Private is usually the better answer than Password. It lets you invite by email and needs no shared secret.
- Previews stay private by default, including Deploy Previews, agent-run previews, and branch deploys.
- Private projects can’t receive third-party webhooks. Slack, Stripe, and the rest need a public project.
- Team login excludes Git Contributors, and every employee who passes it needs a paid Netlify seat.
- Firewall rules run before any login prompt, so a blocked IP sees an error page instead.
Three different things called “auth”
Before changing any setting, it’s worth knowing which of three unrelated layers you actually want, because they get conflated constantly and the sessions are entirely separate.
Password Protection and project visibility answer “can this request load the site at all.” That’s the platform perimeter, and it’s what this article covers.
Netlify Identity answers “who is this user inside my app.” App login, OAuth providers for your users, roles. See How to add user login to a Netlify site with Identity.
Team and Org SAML SSO answers “can you log into the Netlify dashboard.” That’s team member access to Netlify itself.
If you’re not sure which you need, Netlify auth: site protection, app login, or team SSO? walks through it properly. One thing worth noting now: the same provider, say Google, can be an Identity OAuth provider for your app users and a SAML IdP for your team members. Those are unrelated pieces of wiring.
Pick the layer
| Goal | Use |
|---|---|
| Restrict site to your team, invite by email | Private project (credit-based) or team login protection |
| Shared password anyone can use | Basic password protection, or Password visibility (Pro only) |
| Protect only previews, keep production open | ”Non-production deploys only” / “Previews only” |
| Require SSO to view the site | Org/Team SSO with Only SSO allowed (strict) plus team login protection |
| Log in users inside your app | Netlify Identity |
| Single company-wide app SSO, no double login | The Auth0 extension |
That last row matters more than it looks. If what you want is company-wide app-level SSO with a single sign-in, reach for the Auth0 extension federating to your corporate IdP, before stacking a perimeter on top of Identity. The reason is in the failure modes below.
Worked example
Setting a password (credit-based, Pro)
- Go to the project, then Project configuration > General > Visitor access > Project visibility.
- Click Edit visibility. If a team default is set, choose Customize this project’s visibility to override it.
- Select Password and enter the password. You share it with visitors yourself; there’s no default.
- Choose Preview access: Production and previews, or Previews only.
- Save. Later you can use Change password, or remove protection by choosing Public or Private.
Password Protection (Enterprise, Open Source, legacy)
Go to the per-site or team-default path, then Configure Password Protection. If a team default exists, choose Customize this site’s protection settings. Then pick:
- Basic password protection: a single shared password.
- Team login protection: Netlify team login, SSO-capable.
Scope it to All deploys or Non-production deploys only, and Save.
Requiring SSO to view a site
- First set up Organization SSO or Team SSO.
- Configure Password Protection and choose Team login protection.
- To force SSO rather than allow it, set the SSO config to Only SSO allowed (strict).
Dashboard paths
Credit-based (Project visibility):
- Per-project: Project configuration > General > Visitor access > Project visibility
- Team default: Team settings > General > Visitor access > Default project visibility
Enterprise, Open Source, legacy (Password Protection):
- Per-site: Project configuration > Access & security > Visitor access > Password Protection
- Team default: Team settings > Access & security > Visitor access > Default Password Protection settings
Handling SSO session expiry
SSO auth tokens expire after 1 hour, at which point an SSO-protected site starts returning 401. That’s the “logged out mid-session” symptom.
The platform returns a Netlify-Site-Protection-Expires-In response header giving seconds until expiry. Read it and re-authenticate before it reaches zero:
// SSO-protected site: refresh before the 1-hour token expires to avoid a 401.const res = await fetch(window.location.href, { credentials: "include" });const secondsLeft = Number(res.headers.get("Netlify-Site-Protection-Expires-In"));if (!Number.isNaN(secondsLeft) && secondsLeft < 60) { window.location.reload(); // triggers re-auth via the identity provider}The header name and semantics are documented. The JavaScript above is one illustrative way to use it.
Common failure modes
You went looking for the API and couldn’t find it. There isn’t one. These settings have no public API, no CLI command, and no MCP tool. The dashboard is the only way to inspect or change them.
Users are logged out mid-session, or your SSO-protected site returns 401s. SSO tokens expire after an hour. Read Netlify-Site-Protection-Expires-In and re-auth before expiry.
You stacked a perimeter on top of Identity and now users log in twice. That’s real and it can’t be wired away. A Password-Protection or team-login perimeter session and a Netlify Identity app session have no bridge: no shared cookie, no forwarded header, no JWT exchange. A perimeter session also represents team-member identity rather than an app end-user record with roles, so even a hypothetical bridge wouldn’t cleanly become your app’s user. Don’t spend iterations on it. If single sign-on matters, use invite-only Identity or the Auth0 extension instead.
Your team-login perimeter is costing more than expected. Team login admits only Netlify team members, so every employee who passes it needs a paid Netlify seat. That’s the hidden cost of the genuine two-layer setup.
Git Contributors can’t reach the protected deploy. Team login excludes Git Contributors by design. It applies to Developers, Team Owners, and Billing Admins; Reviewers can be invited without limit.
Your team members keep getting prompted for the password. Basic password protection prompts everyone, managing team members included. Use Private or team login if that’s not what you want.
Your Slack or Stripe webhooks stopped arriving. Private projects can’t receive third-party webhooks. Receiving webhooks requires the project to be public.
A visitor sees an error page instead of a login prompt. Access order puts Advanced Web Security first: firewall rules, WAF, then rate limiting all run before any password or login prompt. A blocked IP never reaches the prompt.
“Make public” is greyed out. Making a project public requires at least one successful production deploy. Also note Internal Builders can’t publish to production, so they can’t make a project public.
You can’t invite anyone. Free and Personal are single-seat; upgrade to Pro to invite. On Free and Personal, a private project is visible only to the Team Owner.
A new project came out private when you expected public, or vice versa. Team defaults changed by creation date: teams created on or after July 28, 2026 default to Private for new projects, and teams created before that default to Public.
You’re looking for a setting under an old name. “Site-wide password protection” is now part of Password Protection. “Selective password protection” was the old name for Basic authentication with custom HTTP headers, which is code you author rather than a platform setting.
Reference
Project visibility values (credit-based)
One visibility setting plus a separate scope.
| Visibility | Who can load the site |
|---|---|
| Public | Anyone with the URL |
| Private | Team and invitees only, enforced with Netlify login. Invite by email, no password needed. Recommended for restricting to your team. |
| Password | Public but requires a shared password. Pro only among credit-based plans. |
Scope: Production and previews, or Previews only. Previews stay private unless you change preview visibility, and that includes Deploy Previews, agent-run previews, and branch deploys. There is no default shared password; set one per project.
UI naming by plan
Same mechanism, different labels.
| Plan | Per-project setting | Team-level setting |
|---|---|---|
| Credit-based Free / Personal / Pro | Project visibility | Default project visibility |
| Enterprise / Open Source / legacy | Password Protection | Default Password Protection settings |
Legacy to credit-based translation
| Password Protection (old) | Project visibility (new) |
|---|---|
| No protection settings | Public |
| Basic protection | Password |
| Team protection | Private |
| All deploys | Production and previews |
| Non-production deploys only | Previews only |
Team defaults
| Default | Effect |
|---|---|
| Private for new projects | New projects start behind team login; existing keep their visibility |
| Private for all projects | New and all existing locked to team login; none can be made public |
| Public for new projects | New projects are public; existing keep their visibility |
Plan gating
| Feature | Plans |
|---|---|
| Basic password (whole site) | Pro and Enterprise |
| All options including team login | Enterprise |
| Project visibility | Credit-based Free / Personal / Pro only |
| Private project visibility scope | Free and Personal: Team Owner only. Pro: unlimited members. |
| Enterprise / OSS / legacy | No project visibility, so use team login protection |
| Protecting only non-production deploys (Password Protection path) | Enterprise only |
| Invites | Free and Personal are single-seat. Pro invites unlimited members to one project or the whole team. |
Who can change these
| Setting | Who |
|---|---|
| Password Protection (per-site) | Developer |
| Password Protection (team default) | Team Owner |
| Project visibility | Org Owners on certain Enterprise plans, Team Owners, Developers with project access |
Access order
Advanced Web Security runs first: firewall rules, then WAF, then rate limiting. Only after those does any password or login prompt appear.
The four ways to combine a perimeter with per-user identity
Ordered from least to most friction.
| Option | Logins | Plans | When |
|---|---|---|---|
| A. Invite-only Netlify Identity | One | All (free) | Best default for “just my team.” Identity is both perimeter and in-app identity. Manual invite management; doesn’t scale to thousands. |
| B. Auth0 extension | One (federated SSO) | Auth0 extension, enterprise-oriented | Best for a real org with an existing IdP (Okta, Entra, Google Workspace). Supports auto-provisioning. |
| C. Basic Password Protection + Identity | Two, but the first is a shared secret | Pro+ for the gate | ”Keep the public out while we build” plus real user accounts. The password is easily forwarded, so treat it as a soft gate. |
| D. Enterprise team-login perimeter + Identity | Two | Enterprise | Only when a true CDN-edge perimeter is a hard requirement and the double login is acceptable. Every employee needs a paid Netlify seat. |
One note on unofficial workarounds: a netlify/netlify-plugin-identity-sso repo once attempted to bridge the two sessions. It’s unofficial, dormant since 2021, and hardcoded for @netlify.com emails. Don’t build on it.
FAQs
How do I password protect a Netlify site? On credit-based plans, go to Project configuration > General > Visitor access > Project visibility, choose Password (Pro only), enter a password, and pick whether it covers production and previews or previews only. On Enterprise and legacy plans, use Password Protection under Access & security.
Is there an API or CLI command for Netlify password protection? No. These settings have no public API, no CLI command, and no MCP tool. The dashboard is the only surface.
How do I protect only my deploy previews and leave production public? Set the scope to Previews only (credit-based) or Non-production deploys only (Password Protection). Note that for the Password Protection path, protecting only non-production deploys is Enterprise-only.
What’s the difference between Private and Password? Private restricts the site to your team and invitees, enforced with Netlify login, and lets you invite by email with no shared secret. Password makes the site publicly reachable but gated by one shared password, and it’s Pro-only among credit-based plans.
Are my deploy previews public by default? No. Previews stay private unless you change preview visibility. That covers Deploy Previews, agent-run previews, and branch deploys.
Why do users have to log in twice? Because a perimeter session (Password Protection or team login) and a Netlify Identity app session are independent, with no shared cookie or token exchange. If you need a single sign-in, use invite-only Identity or the Auth0 extension rather than stacking layers.
Why is my SSO-protected site returning 401 after a while?
SSO auth tokens expire after 1 hour. Read the Netlify-Site-Protection-Expires-In response header and re-authenticate before it reaches zero.
Why aren’t my webhooks arriving? Private projects can’t receive third-party webhooks. The project has to be public to receive them.
Can Git Contributors access a team-login-protected site? No. Team login excludes Git Contributors. It applies to Developers, Team Owners, and Billing Admins, and Reviewers can be invited.
How do I require SSO to view a site? Set up Organization or Team SAML SSO first, then configure Password Protection with Team login protection, and set the SSO config to Only SSO allowed (strict) to force it.
Related
- Configure Team SAML SSO
- Configure Organization SAML SSO
- Basic authentication with custom HTTP headers
This article is generated from Netlify’s open-source agent guidance at netlify/context-and-tools, the same reference our AI coding agents use.
Need to lock something down? Start at netlify.new.