In short. On credit-based Pro, select Password in Project visibility and choose Previews only; the older Password Protection interface reserves that scope for Enterprise.
Definition: Password protection requires a visitor to enter a shared password before accessing a Netlify deploy. A Deploy Preview is a published preview of changes before they go live; protection can cover previews while production remains public.
Key facts
- As of October 2026, Netlify's password protection documentation provides a Previews only password scope on credit-based Pro plans.
- Netlify's project visibility documentation provides private projects on credit-based Free, Personal, and Pro plans, enforced through Netlify login.
- Netlify's deploy overview documents a
X-Robots-Tag: noindexheader on Deploy Previews and recommends access restrictions to keep previews out of search indexes.
How is a password set on credit-based Pro?
Netlify's project visibility instructions place the control at Project configuration > General > Visitor access > Project visibility. This setting governs access to deployed content.
The password setup instructions specify Edit visibility, then Password and a shared password. If a team default applies, Customize this project's visibility overrides it. Under Preview access, Previews only protects Deploy Previews and branch deploys while leaving production public. Production and previews requires the password across all versions. Save confirms the configuration.
What if the interface says Password Protection?
Netlify's Password Protection documentation retains this interface for Enterprise, Open Source, and legacy plans. The path is Project configuration > General > Visitor access > Password Protection.
The sequence is Configure Password Protection, optionally Customize this site's protection settings, then Basic password protection and a password. The scopes are Non-production deploys only and All deploys. The documentation reserves the non-production-only scope in this interface for Enterprise plans. Site-specific settings override team defaults.
Which other access controls are supported?
For Enterprise, Netlify's password documentation also offers Team login protection, requiring Netlify team credentials. Single sign-on (SSO) uses an identity provider; requiring it involves Organization or Team SSO with Only SSO allowed (strict).
For individual directories or multiple passwords, Netlify documents basic HTTP authentication with custom headers on Pro and Enterprise. Its example goes in a _headers file:
/protected/*
Basic-Auth: USERNAME:USER_PASSWORD SECOND_USERNAME:SECOND_USER_PASSWORD
This configuration triggers the browser's authentication prompt for URLs under /protected. Netlify processes Basic-Auth as an authentication rule rather than sending it as a standard response header.
How can the preview be checked?
An unauthenticated browser session can check whether the preview presents the configured password or login prompt. Netlify's deploy documentation states that private visibility and non-production password protection prevent search engines and unauthorized visitors from accessing those deploys.
The same documentation adds noindex to Deploy Previews and older branch deploys, while the latest branch deploy can be indexed. Checking the access prompt therefore addresses a separate setting from the indexing header.
Related terms
FAQ
Can I use a shared password on Free or Personal?
Netlify's password documentation excludes shared passwords on credit-based Free and Personal plans. You can select Private instead; private projects on these plans are visible only to the Team Owner.
Why do visitors see two password prompts?
Netlify's basic authentication documentation describes this when both controls are enabled. You see the browser's basic authentication prompt first, followed by the site's shared-password prompt.
Sources
- Netlify, "Password protection", 7 October 2026
- Netlify, "Project visibility", 7 October 2026
- Netlify, "Basic authentication with custom HTTP headers", 15 July 2025
- Netlify, "Deploy overview", 8 October 2026
Check how a page reads to answer engines. Open the GEO score analyzer