Guide
How to password protect a static site on Netlify, Vercel, GitHub Pages, Cloudflare, S3 or Azure
Updated 30 October 2026
Most static hosts can put a site behind a password or a login, but rarely on the free plan. Netlify needs Pro, $20 a month. Vercel charges $20 a month per protected project on Pro, Azure Static Web Apps needs its Standard plan, and GitHub Pages has no password at all. Cloudflare Pages and Amazon S3 hand the job to another service: Cloudflare Access and AWS Amplify Hosting. For one report rather than a whole site, a document host like ashare.net puts the password, or a list of emails, on that one link.
What each platform offers
| Platform | Shared password | Sign-in instead | What it needs |
|---|---|---|---|
| Netlify | Yes | Private project: a Netlify login for your team and invited people | Pro, $20 a month; not on Free or Personal |
| Vercel | Yes | Vercel Authentication: a Vercel account with access | Password: Pro ($20 a month) plus $20 a month per project; Vercel Authentication on every plan |
| GitHub Pages | No | Read access to the repository | GitHub Enterprise Cloud, $21 per user a month |
| Cloudflare Pages | No | Cloudflare Access: allowed emails or domains, a one-time PIN or your identity provider | Zero Trust Free for up to 50 users, then $7 per user a month |
| Amazon S3 | Not on the website endpoint | — | Amplify Hosting: a user name and password per branch |
| Azure Static Web Apps | Yes | Built-in authentication with an identity provider | Standard plan |
Netlify
A shared password for the whole site comes with Pro and Enterprise; credit-based Free and Personal plans don’t have it. On a credit-based Pro plan open Project configuration → General → Visitor access → Project visibility, choose Edit visibility → Password, and pick whether it covers production and previews or previews only. The other choice is Private visibility: visitors sign in with a Netlify account. On Free and Personal only the team owner opens a private project; on Pro you invite people by email. See Netlify’s docs.
Vercel
Settings → Deployment Protection picks a method and a scope. The scope is Standard Protection, every URL except production domains, or All Deployments, production included. Both work on every plan. Vercel Authentication is free, but each visitor logs in to Vercel and needs access to the project, and Hobby allows one external user per account. Password Protection isn’t on Hobby; on Pro it costs $20 a month for each protected project, and Enterprise includes it. See Vercel’s docs.
GitHub Pages
GitHub Pages has no password option. Pages works from public repositories on GitHub Free, and from private ones on Pro, Team and Enterprise, but GitHub warns that the site is public on the internet even when the repository is private. Only an organization on GitHub Enterprise Cloud can publish a project site privately, and then only people with read access to the repository open it. A common workaround on a public Pages site is an encrypted page: see how to password protect an HTML page for how that works and where it falls short.
Cloudflare Pages
Cloudflare protects Pages with Cloudflare Access. Settings → General → Enable access policy covers preview deployments only, not the *.pages.dev domain or a custom domain. To cover those, follow Cloudflare’s known issues page: edit the Access application to drop the wildcard, and add a self-hosted Access application for the custom domain. Access can send a one-time PIN to allowed emails, or to anyone on a domain, so outside readers need no account. The Zero Trust Free plan covers up to 50 users.
Amazon S3
An S3 website endpoint serves only publicly readable content and doesn’t support HTTPS, so there is nowhere to put a password. AWS recommends Amplify Hosting for static sites stored in S3. Its access control asks for a user name and password on one branch or on all of them, and throttles failed attempts. See Amplify’s docs.
Azure Static Web Apps
Password protection needs the Standard plan. Open Configuration → General settings → Password protection and choose staging environments only, or production and staging. The password needs at least eight characters with a capital letter, a lowercase letter, a number and a symbol. Microsoft calls it a lightweight feature with a limited level of security and points to built-in authentication for more. See Microsoft’s docs.
For one report, not a whole site
A site password protects a deployment: a repository, a build, a domain. When you only need to send one report, dashboard or prototype to a few people, that is a lot to set up and pay for. On ashare.net the protection belongs to the document. Upload the file on My documents, or let your agent or a script publish it:
$ npx ashare-cli publish report.html --visibility public --password "<password>" --expires 14d
$ npx ashare-cli publish site/ --visibility company- Password. Each reader enters it once per browser and stays in for 7 days. A new password signs everyone out, and an expiry ends the link on a date.
- Specific people. Up to 100 emails per document; each reader signs in with a 6-digit code from their email, no account to create.
- Your company. Everyone who signs in with an email on your company’s domain.
For private and company documents you see who opened them and when. A folder goes up as a small site of up to 200 files and 25 MB, with pages that link to each other. Prices: Free for a personal email, Pro $5 a month, Company $30 a month for the whole domain; see Pricing.
Stay on your host when the site is your product: a custom domain, a build from Git, many pages. ashare.net has no custom domains and isn’t meant to host a website.
ashare.net: your agent publishes HTML or Markdown and you choose who opens it: your company, specific emails or a password. Readers comment, the agent fixes the document.
Connect your agent