In short. Enable Vercel Authentication with Standard Protection to restrict preview access while keeping production domains public, then review access exceptions.
Definition: Vercel Deployment Protection controls access to preview and production URLs through a protection method and a URL scope. As of 17 October 2026, Standard Protection with Vercel Authentication restricts preview access to authorized visitors while leaving production domains public.
Key facts
- Vercel's Deployment Protection documentation lists Standard Protection and All Deployments as scopes available on all plans.
- The Vercel Authentication documentation makes this method available on all plans and requires visitors to have deployment access.
- Vercel's Password Protection documentation describes a password entered before access and makes this method available on Pro and Enterprise plans.
- Vercel's Trusted IPs documentation supports IPv4 addresses and IPv4 CIDR ranges, which describe address blocks. This Enterprise feature requires Vercel Authentication when enabled for previews. The same documentation recommends migrating IP access controls to Vercel Firewall.
How is preview protection enabled?
Vercel's Deployment Protection overview places the controls under the selected project's Settings, then Deployment Protection. The method determines how visitors gain access; the scope determines which URLs require it.
For Vercel Authentication, the setup instructions specify enabling the toggle, selecting the environment and saving. Selecting Standard Protection covers previews while keeping production domains public. The setting applies to existing and future deployments in the selected environments.
The same instructions provide this request body for updating an existing project through the Vercel API:
{
"ssoProtection": {
"deploymentType": "prod_deployment_urls_and_all_previews"
}
}
The deploymentType value selects Standard Protection. The value all selects All Deployments.
Which URLs does each scope protect?
Vercel's scope descriptions distinguish the current settings from legacy settings:
| Scope | Protected URLs and public access |
|---|---|
| Standard Protection | Protects all deployments except production domains, including the generated production deployment URL. |
| All Deployments | Protects previews and production, including production domains. |
| (Legacy) Standard Protection | Protects preview and deployment URLs; up-to-date production URLs remain public. |
| (Legacy) Pre-Production Deployments | Protects preview URLs; past and current production URLs remain public. |
| Only Production Deployments | Uses Trusted IPs on Enterprise; preview URLs remain public. |
The production-only option therefore leaves previews exposed. Standard Protection also changes access to generated production URLs used by application requests. The same documentation advises changing requests based on VERCEL_URL or VERCEL_BRANCH_URL to target the domain requested by the visitor. For client-side requests, relative paths include the authentication cookie automatically.
How can access be checked without overlooking exceptions?
The Vercel Authentication documentation describes a login redirect for visitors. Authorized users return to the deployment with a browser cookie; users without permission reach an access request. A practical check is to open the preview in a browser session without an existing Vercel login, then verify the intended production domain separately against the selected scope.
Vercel's bypass documentation identifies settings that change this result. Deployment Protection Exceptions make specified preview domains public. Shareable Links allow external access through a secure URL parameter, while Protection Bypass for Automation uses a secret across a project's deployments. These settings belong in the access review alongside the main protection toggle.
Related terms
- How do I give an automated checker access to a protected Vercel deployment?
- How do I add an X-Robots-Tag header on Vercel?
- Where do I manage AI bot access in Vercel?
FAQ
Can I give an external reviewer access?
Yes. Vercel's access request documentation lets external Vercel users request access, which can be approved, declined or later revoked. Approved users can view the latest deployment from a specific branch while logged in.
Can reviewers sign in through my company's identity provider?
Vercel's Passport documentation describes Enterprise deployment protection through an external identity provider. It names Microsoft Entra ID and Okta as examples and supports OpenID Connect compatible providers.
What happens if I disable Vercel Authentication?
The same Vercel Authentication documentation states that disabling Vercel Authentication removes its protection from existing deployments. Previously authenticated visitors can retain access after re-enabling it when their deployment cookie remains set.
Sources
- Vercel, "Deployment Protection on Vercel", 15 September 2026
- Vercel, "Restrict access to deployments with Vercel Authentication", 15 September 2026
- Vercel, "Password Protection", 15 September 2026
- Vercel, "Restrict deployment access by IP address", 28 August 2026
- Vercel, "Bypass Deployment Protection for testing, sharing, and automation", undated
- Vercel, "Restrict access to deployments with Passport", 21 September 2026
Check how a page reads to answer engines. Open the GEO score analyzer