Password-protect a site, or share it privately with a client
Some sites are for a client, a team or a handful of invited people, not for the whole internet. Every VibeDeploy site has a visibility setting that the server checks before it sends a single file: a shared password, sign-in for your team, email invitations or a list of allowed networks. The check applies on every address of the site, and the servers are in Belgium.
Six settings in the dashboard
Each site uses exactly one of these settings, and you can switch at any time:
Everyone
The default: anyone can visit, and search engines can find the site.
With a password
One shared password for the whole site. A visitor types it once and that browser stays unlocked for 24 hours.
Only me, My team
The site opens only after signing in to VibeDeploy as a member of your team. On a one-person account that means you alone, which suits drafts.
Invite only
You add email addresses; each person gets a personal access link by email, and people who are not on the list cannot get one.
Specific networks
Only visitors from the IP addresses or ranges you list can open the site, such as an office network or a VPN.
Password protection, Only me, My team, Invite only and Specific networks are included from Maker (€15 a month). See the plans
Password-protect a static site or a single HTML page
Put the site online first: upload a ZIP, a folder or one HTML file, or let your AI deploy it. Then open the site's settings, choose With a password, type the password and save. From then on every request goes through a check on the server, so the HTML, images and scripts are only sent after the right password. It is not a JavaScript overlay that someone can read around in the page source. The password covers the whole site; to protect one page on its own, publish that page as a separate site.
Share a website privately with a client
For one client contact, a password is the quickest: send the link and the password separately. For several reviewers, or when you would rather not pass a password around, use Invite only (Maker and up): add their email addresses and each person gets a personal access link by email. Remove someone from the list and their access ends.
Client preview links
The preview link is simply the site's own address: its platform subdomain, or the client's domain once it points to VibeDeploy (test unlocking there first). Keep the site behind a password or Invite only while the client reviews it, then switch it to Everyone on launch day; the address stays the same. To review a redesign while the current site stays public, publish the new version as a separate site with its own password and deploy it to the live site once it is approved. If you build sites for clients regularly, the page for agencies goes deeper.
Protection on your custom domain
The setting travels with the site: the same password, invitation or network rule is enforced whether someone visits your own domain or the platform subdomain. Add your domain in the site settings and HTTPS is set up automatically. Before you send a client a link on your own domain, test that unlocking works there.
Internal pages for your team
Team handbooks, onboarding guides, reference pages built from exported data, a members page for a club: more internal tools are static sites than you would think. Put the site on My team and everyone on your team can open it after signing in, while the public web sees nothing, or use Invite only to add specific outside people.
Network allowlists for stricter setups
Specific networks limits a site to the IP addresses or ranges you list (Maker and up), which suits an intranet page reached over the office network or a VPN. The Business plan adds a separate allowlist for the dashboard itself, so only approved networks can sign in to manage your sites. The Business page covers the full set of controls.
What Netlify and Vercel charge for this
To be fair, Netlify and Vercel are both excellent platforms. Netlify's documentation reserves site-wide password protection for its Pro and Enterprise plans (not Free or Personal), and Vercel's lists Password Protection on Pro at $20 per protected project per month, included on Enterprise and not available on Hobby. On VibeDeploy, password protection and the sign-in, invitation and network modes come with Maker. See the full comparisons: VibeDeploy vs Netlify and VibeDeploy vs Vercel.
Frequently asked questions
Is the password checked on the server?
Yes. The web server checks every request before it sends a file, so the page, its images and its scripts stay locked until the right password is entered. There is no script in the page that a visitor could switch off or read around.
Which plan do I need?
Password protection, Only me, My team, Invite only and Specific networks are included from Maker at €15 a month, which also gives you 3 sites. Every account starts with a 14-day trial without a card.
Can I share a site with a client without a shared password?
Yes, with Invite only (Maker and up). Add the client's email address and they get a personal access link by email; remove the address and their access ends. People who are not on the list cannot get a link.
Can I password-protect only the staging copy?
Not today. Staging (Studio and up) gives a site a second address for checking changes before you promote them, but that address has no password of its own. For client review, publish the preview as a separate site and protect that one.
Does it work with a custom domain?
It is enforced there as well: the setting belongs to the site, so the same password, invitation or network rule guards your own domain and the platform subdomain, and HTTPS for the domain is automatic. Test unlocking on your own domain before you share a link there.
Is a password enough for sensitive data?
It controls who can view the site, and the check happens on the server, not in the page. That is right for previews, internal pages and anything you just do not want public. For regulated or truly sensitive data, use Invite only or My team so every viewer is identified, and use your own judgment about what should be on a website in the first place.
Does password protection work for a site that runs a container app?
Not for the container's public part yet. The password, sign-in and invitation checks run in the web server that serves the site's files, so a public container service cannot sit behind them; in those modes the container is taken off the public address until you switch back. Specific networks does work with container apps.
Your site, your audience, nobody else
Deploy a site, choose who can see it, add your own domain. Hosted in Belgium, 14-day trial, no card.