On July 28, 2026, Netlify started making new projects private by default. If your Netlify team already existed on that date, nothing about your projects changed. They are still public, and Netlify did not send you a migration.
That gap is the whole point of this post. The announcement reads like a platform-wide security upgrade. It is opt-in for everyone who was already there.
TL;DR
Netlify's private-by-default only applies to new teams on credit-based Free, Personal, and Pro plans. Existing teams keep the old public default until someone turns it on at Team settings > General > Visitor access > Default project visibility. Changing that default does not retroactively lock projects you already deployed. And private visibility hides the page, not the API keys compiled into it.
What Netlify actually shipped
The feature is called project visibility. A project set to private can only be viewed by logged-in members of your Netlify team, at the live URL and inside Netlify itself. Public is the old behaviour: deploy, get a URL, anyone with the URL can load it.
Here is the part that determines whether this affects you at all:
| Situation | What happened on July 28 |
|---|---|
| New team, credit-based Free / Personal / Pro | New projects start private |
| Existing team, credit-based plan | Default stays public, opt in yourself |
| Legacy pricing plan | No project visibility settings at all |
| Enterprise plan | No project visibility settings, use Team login protection |
| Open Source plan | No project visibility settings |
Two settings control it, and they are in different places:
- Team default, for everything created from now on: Team settings > General > Visitor access > Default project visibility
- One project, including ones you already have: Project configuration > General > Visitor access > Project visibility
Production deploys and previews are configured separately. A project can be private in production and still serve public deploy preview URLs, which is the arrangement most likely to bite you, because previews are where the half-finished admin panel lives.
Flipping the team default to private does not reach backwards. It governs new projects. The eleven projects already in your dashboard stay exactly as public as they were this morning.
Check whether you're actually private
Four minutes, and you will know rather than assume.
Read the team default. Team settings > General > Visitor access > Default project visibility. If it says public and you have been on Netlify since before late July, that is the untouched original, not a choice anyone made.
Walk your project list. Open Project configuration > General > Visitor access for each project. Note that production and preview visibility are two separate controls. Set both.
Verify from outside. The dashboard tells you what it believes. A request with no session tells you what the internet sees.
# no cookies, no Netlify session, exactly what a stranger gets
curl -s https://your-project.netlify.app | head -40
# same for a deploy preview
curl -s https://deploy-preview-12--your-project.netlify.app | head -40
If your app's HTML comes back, it's public. Do this from a private browsing window too, since a logged-in browser will happily show you a private project and leave you thinking it's locked.
Check what you built while it was open. If a project has been live and public for months, private-from-now-on doesn't retrieve anything. Grep the built bundle for the prefixes that get compiled in:
npm run build
grep -rEo "(VITE_|NEXT_PUBLIC_|REACT_APP_)[A-Z0-9_]+" dist/ .next/ build/ 2>/dev/null | sort -u
Every name that comes back was readable by anyone who loaded your site. Rotate the ones that are real secrets.
What private visibility does not do
This is where founders get a false sense of finishing. Private is access control on one URL. It is not a security posture.
A private Netlify project with a Supabase anon key in the bundle and no row-level security is exactly as exposed as it was before. Netlify controls who reaches your frontend. It has no opinion about who reaches your database.
Three specific things private does not cover.
Your keys are still in the bundle. Anything prefixed VITE_, NEXT_PUBLIC_ or REACT_APP_ is compiled into JavaScript that ships to whoever can load the page. Private shrinks that audience to your team. It doesn't remove the key. The day you make the project public, every deferred exposure lands at once. See how to fix Netlify API key exposure if you're already in that position.
Your backend is a different host. Your Supabase project, your Firebase instance, your API server: none of them are behind Netlify's visibility check. They have their own URLs and their own auth. Someone who read your bundle once, back when the project was public, holds those endpoints forever. Making the frontend private later changes nothing for them.
Anything already scraped stays scraped. Public deploy URLs get indexed, archived and crawled by tooling you never invited. Going private stops future access, not past copies.
We see the same order-of-operations mistake in scans constantly: the hosting is locked down and the database it talks to accepts anonymous reads on every table. The lock is on the front door of a building with no walls.
The plan trap that makes people undo it
On Free and Personal plans, a private project can be viewed only by the Team Owner. Not by collaborators. Not by a client you want to show progress to. Only you.
On Pro, you can invite unlimited team members to view a private project.
So the realistic sequence for a solo founder on a Free plan is: enable private, try to send a client the link, discover the client gets nothing, switch the project back to public to unblock the demo, and forget to switch it back. That last step is the one that ends up in a scan report.
If you need to show work to someone outside your team without going fully public, password protection is a separate Netlify feature that doesn't require them to have a Netlify account. Use that for client review instead of toggling visibility back and forth.
A reasonable configuration
For most vibe-coded projects on a credit-based plan:
- Team default: private. New experiments should not land on a public URL by reflex.
- Production visibility on your one real live app: public, deliberately, once it's ready.
- Preview visibility everywhere: private. Deploy previews are drafts, and drafts of an admin dashboard are worth hiding.
- Everything else, the prototypes and the abandoned rebuilds: leave them private and stop thinking about them.
Then treat all of that as a convenience, not a control. The security work is still the same work: keep real secrets out of the client bundle, put row-level security on your database, and set your headers. Deploying Netlify securely covers those in order.
Did Netlify make my existing projects private?
No. Netlify's project visibility change on July 28, 2026 set new projects to private by default for new teams on credit-based Free, Personal, and Pro plans. Existing teams keep the previous default, which is public, so nothing changed for projects you already had. You have to turn it on yourself in Team settings > General > Visitor access > Default project visibility.
How do I make my Netlify project private?
For one project: Project configuration > General > Visitor access > Project visibility. For everything new on the team: Team settings > General > Visitor access > Default project visibility. Production deploys and previews have separate settings, so setting one does not set the other.
Can I share a private Netlify project with a client?
It depends on your plan. On Free and Personal plans, a private project can only be viewed by the Team Owner, so there is no way to hand a client a preview link without making the project public. On Pro you can invite unlimited team members to view it. This is the most common reason people turn the setting back off.
Does making a Netlify project private protect my API keys?
No. Private visibility controls who can load the page. Any key compiled into your JavaScript bundle with a VITE_, NEXT_PUBLIC_ or REACT_APP_ prefix is still in that bundle, readable by anyone who can view the project and by everyone the moment you flip it public. If a key was exposed while the project was public, rotate it.
Are deploy previews private too?
They can be, but it is a separate setting. Netlify treats production deploys and previews as independent visibility settings, so a project can have a private production URL and public preview URLs. Check both.
Private URL, Public Database?
Locking the Netlify URL is one layer. Find out what your app still exposes to anyone who has ever loaded it. 60 seconds, no signup.