Password Protect a Website for Free

Three platforms let you password protect a website for free. Light Cloud does it with one shared password, set in four clicks on every plan, Free included. Cloudflare Access is free for teams under 50 people and makes each visitor sign in with a code sent to their email, which is safer and takes about a dozen steps to set up. Render has no setting for it, but its blog shows how to encrypt a static page at build time with PageCrypt. Everywhere else the password sits behind a paid plan: $20 a month on Netlify, $21 per user on GitHub, $29 on Koyeb and $40 on Vercel for one developer and one project.

We make Light Cloud, so it's our row at the top. Below is how the order was decided, and every row links to the vendor's own page so you can check it.

The September price change that started this

On 2026-09-09 Vercel moved Password Protection from a $150-a-month team add-on to $20 per protected project a month on Pro. For a team with one project, that's a price cut. An agency with ten client projects now pays $200 a month, more than the old add-on. The same day, Vercel let its account-based gate, Vercel Authentication, protect production deployments too, at no cost on every plan.

Answers to "how do I lock a staging site for free" tend to mix three different things: a shared password, a login with a personal account, and code you write yourself. They're priced very differently, so this table keeps them apart.

How we ranked

The scenario is the one I meet most: a commercial project has a staging site, and a client who has no account anywhere needs to open it, while search engines and strangers must not.

Each platform is priced on the cheapest plan where its own protection works, for one developer and one site, using list prices checked on 2026-10-13. "Commercial" rules out plans that forbid it, such as Vercel's Hobby. Ties on price are broken by the number of steps, which I counted from each vendor's own instructions, starting at the settings page and leaving out sign-up.

The table also says what the visitor has to type. A shared password is the least work for the client. Personal logins are better security, and more work for everyone. Neither is wrong.

The ranking

#PlatformWhat the visitor entersPlan it needsPassword on one site a month

1

Light Cloud

A staging site that one shared password should cover, set in four clicks on any plan

$0

A staging site that one shared password should cover, set in four clicks on any planPrice: every plan, Free included

What the visitor entersOne shared passwordPlan it needsEvery plan, Free included

$0

every plan, Free included

2

Cloudflare

Teams that want every visitor to sign in as themselves, free for under 50 people

$0

Teams that want every visitor to sign in as themselves, free for under 50 peoplePrice: Access, under 50 users

What the visitor entersEmailed code or company loginPlan it needsAccess Free, under 50 users

$0

Access, under 50 users

3

Render

A small static site where a password baked into the page at build time is good enough

$0

A small static site where a password baked into the page at build time is good enoughPrice: PageCrypt, static sites

What the visitor entersShared password, one HTML filePlan it needsAny plan, static sites only

$0

PageCrypt, static sites

4

Netlify

Agencies that want a shared password on every project for one flat monthly price

$20

Agencies that want a shared password on every project for one flat monthly pricePrice: Pro, flat, any number of sites

What the visitor entersOne shared passwordPlan it needsPro, $20 a month

$20

Pro, flat, any number of sites

5

GitHub Pages

Internal docs for people who already have read access to the repository

$21

Internal docs for people who already have read access to the repositoryPrice: per user, Enterprise Cloud

What the visitor entersGitHub sign-in with repo accessPlan it needsEnterprise Cloud, $21 per user

$21

per user, Enterprise Cloud

6

Koyeb

An API or app that should answer only to a username and password, set with one CLI flag

$29

An API or app that should answer only to a username and password, set with one CLI flagPrice: Pro, required for new users

What the visitor entersUsername and passwordPlan it needsPro, $29 a month

$29

Pro, required for new users

7

Vercel

Teams already on Pro that need a shared password on one or two projects

$40

Teams already on Pro that need a shared password on one or two projectsPrice: $20 Pro seat + $20 per project

What the visitor entersOne shared passwordPlan it needs$20 per project on Pro

$40

$20 Pro seat + $20 per project

8

Railway

Large teams that want staging services behind Railway accounts

$5,000

Large teams that want staging services behind Railway accountsPrice: committed-spend tier

What the visitor entersRailway account sign-inPlan it needs$5,000 a month tier

$5,000

committed-spend tier

List prices and setup steps from each vendor's own docs and pricing pages, checked 2026-10-13, US dollars. Scenario: the staging site of a commercial project that a client without an account must open, on the cheapest plan where the vendor's own protection works, for one developer. Steps are the actions each vendor's docs list, counted from the settings page.

1. Light Cloud

Best for: a staging site that one shared password should cover.

Password protection works on every plan, and the tutorial runs on Free: open the environment's Security tab, click Set password, type it twice, click Save password. It applies from the next request, with no redeploy. The check happens at the edge before the request reaches your app, so images and JavaScript are covered too, and the password page answers with a 401 and X-Robots-Tag: noindex, nofollow.

A few details I like. The password belongs to one environment, so production stays public while the staging branch is locked; the branch preview tutorial shows how a branch gets that environment in the first place. A visitor stays signed in for 12 hours. After 8 wrong guesses from one address within 15 minutes, further attempts are refused for a while. Clicking Change signs everyone out, which is what you want when a review ends. That's the whole of how we password protect a website for free: it comes with free hosting with no credit card, for static sites and containers alike.

Now the limits. Everyone shares one password, so you can't remove one person without changing it for all. There's no single sign-on. On Free the site lives on a light-cloud.io address with a small "by Light Cloud" link; a custom domain with automatic SSL starts on Lite at $5 a month.

2. Cloudflare

Best for: teams that want every visitor to sign in as themselves.

Cloudflare doesn't do shared passwords. It does Cloudflare Access, which is $0 for teams under 50 users and $7 per user a month, paid annually, above that (Access pricing). For preview links on Pages it's one setting, Settings > General > Enable access policy, which limits them to your Cloudflare account until you add people. That setting doesn't cover the pages.dev domain or a custom domain.

For staging.example.com you create a self-hosted Access application, and the domain has to be active on Cloudflare. The docs list nine actions before the optional settings. A client without a company login signs in with a one-time PIN sent by email, which new organizations add as an identity provider in three more steps. So about a dozen, once. In return you can let in one email address and later remove exactly that one.

3. Render

Best for: a small static site where a password in the page is good enough.

Render has no password setting. Its blog suggests PageCrypt, an open source library that encrypts an HTML file at build time; the browser decrypts it when the visitor types the password. Setup is three steps: add the dependency, change the build command, and set the password as an environment variable. Render's static sites are free, so the cost is $0.

Render is upfront about the catch. PageCrypt encrypts a single HTML file by default, so CSS, JavaScript and images have to be inlined into it to be protected, and there's only one shared password. It's a static-site trick; an API behind it needs its own authentication.

4. Netlify

Best for: agencies that want a password on every project for one flat price.

On the credit-based plans, the shared password comes with Pro, $20 a month with unlimited team members, and it's not available on Free or Personal (docs). Free and Personal can make a project private instead, but then only the Team Owner can see it, which doesn't help with a client.

Five steps under Project configuration > Visitor access > Project visibility: Edit visibility, choose Password, type it, choose Production and previews or Previews only, Save. There's no team-wide default password, so each project gets its own. The flat price is the real draw: the password adds no per-project fee, so twenty client sites don't multiply it.

5. GitHub Pages

Best for: internal docs for people who already work in the repository.

A GitHub Pages site can be published privately only if the organization uses GitHub Enterprise Cloud, which starts at $21 per user a month (pricing). Then only people with read access to the repository can open it, and only project sites from private or internal organization repositories qualify (docs).

The switch itself is three clicks: Settings, Pages, the visibility dropdown. It's a fine answer for an engineering handbook. For a client outside your GitHub organization, it isn't one.

6. Koyeb

Best for: an API or app that should answer only to a username and password.

Koyeb's CLI can put HTTP basic auth on every route of a service with one flag, --auth USERNAME:PASSWORD, or require an API key instead (CLI reference). That's the shortest setup in this table if you live in a terminal, and it protects an API as well as a website.

The price comes from the plan, not the feature. Since Koyeb announced it is joining Mistral AI, new users must pick a paid plan, and Pro is $29 a month with $10 of compute included. The browser shows its own plain sign-in box, which looks dated to a client but works everywhere.

7. Vercel

Best for: teams already on Pro that need a password on one or two projects.

Password Protection is $20 per protected project a month on Pro and isn't available on Hobby. Pro itself is $20 per deploying seat, so one developer with one protected project pays $40. The docs list six actions: pick the project, open Deployment Protection, flip the toggle, pick the environment, type the password, Save.

The free alternative is Vercel Authentication, on every plan. Visitors log in with a Vercel account and request access, which you approve, and Hobby allows one external user. For a team reviewing its own previews it's excellent; for a client it means asking them to create a Vercel account.

8. Railway

Best for: large teams that want staging services behind Railway accounts.

Railway's gate, announced on 2026-10-08, puts services such as staging previews and internal tools behind a Railway login. It requires the $5,000-a-month committed-spend tier. Below that tier, you'd put authentication into the app itself, which is a fine answer, just not a setting.

Where the others beat us

On security, Cloudflare Access wins outright. Each visitor proves who they are, you can remove one person without touching anyone else, and you can plug in a company login. Our shared password can't do any of that, and if it leaks, the fix is to change it and send the new one around. Vercel Authentication and GitHub's private Pages do the same job for teams whose reviewers already have accounts there.

For an agency with many client sites, Netlify's flat $20 covers a password on every project, and its team login can be tied to single sign-on through an identity provider. If you need production itself behind company sign-in, that's what these products are built for.

Where we're ahead is the plain case: a client, a staging link, a password in a message. It's four clicks on any branch preview URL, on any plan, and the git push deploys keep redeploying the protected branch without anyone touching the setting again. If you're choosing a host for the whole app, where to host a SaaS app prices the rest of it.

How many people outside your team need to open your staging site this month?