Can you make a GitHub Pages site private?

I ran into something recently while setting up a GitHub Pages site that I thought would be pretty straightforward. I had a private repository and wanted the website generated from it to be private too. Basically, I didn't want anyone else to be able to open the Pages URL. So I went looking for the setting that would let me do that. I couldn't find it. At first, I thought I was just missing something in the repository settings. But after digging through the GitHub Pages documentation, I realized the problem wasn't that I couldn't find the setting. For most GitHub plans, that setting simply doesn't exist. And the reason this is confusing is that there are actually two different things you can mean by “private.” Private repository ≠ private website A private repository controls who can see your source code. A private website controls who can actually open the published website. Those aren't the same thing. This is probably the part that's easiest to get wrong. If your repository is private, it's natural to assume that anything you publish from it will also be private. Unfortunately, that's not how GitHub Pages works. Two different kinds of private: a private repository still produces a public site What happens with different GitHub plans? The exact options depend on the type of GitHub account you're using, but the basic situation looks like | Plan | Pages from a private repo? | Can the site itself be private? | |---|---|---| | Free (personal) | No | No | | Pro (personal) | Yes | No | | Team (organization) | Yes | No | | Enterprise Cloud (organization) | Yes | Yes, with some restrictions | On the Free plan, there's an extra catch: if you're using GitHub Free, the repository has to be public to use Pages. The Pro plan is where this can get a little misleading. You can keep your repository private and publish the site from it, which sounds like it solves the problem. It doesn't. Your code is private, but the website is still public. Anyone who has the URL can open it. They don't need access to your repository or your GitHub account. So when can a GitHub Pages site actually be private? GitHub does support access-controlled Pages sites, but there are some fairly specific requirements. The private-site option is available with GitHub Enterprise Cloud, and it applies to certain project sites published from private or internal repositories owned by an organization. It isn't something you can enable on a personal GitHub account just by upgrading from Free to Pro. So if you're using GitHub as an individual developer and you're thinking: “I'll just make the repository private, and that should protect the website.” Don't rely on that. Why doesn't GitHub just give us a private/public switch? This is where it helps to separate GitHub repositories from GitHub Pages. Pages is primarily a static-site hosting service. You give it your generated files, and GitHub serves those files as a website. A private website needs something else as well: access control. When somebody requests a page, something needs to figure out: - Who is this person? - Are they allowed to see this site? - Should they be asked to log in? - What should happen if they aren't authorized? - That's a different problem from simply serving static files. GitHub does provide this kind of access control in its Enterprise offering, but regular GitHub Pages sites aren't designed to work as a private, authenticated website. The part I'd be careful about The distinction doesn't really matter if you're hosting a personal portfolio or a public project. It matters a lot if you're using Pages for something that shouldn't be public. For example, imagine you have: - internal documentation - a staging version of a website - a client project that hasn't been released yet - test data - internal tools - configuration files that you accidentally include in the build - You put all of that in a private repository. Then you enable GitHub Pages. The repository can remain private while the resulting website is publicly accessible. That's the part I think is worth remembering. Don't treat GitHub Pages as private just because the repository is private. And don't assume that an obscure URL is enough protection either. If something is genuinely sensitive, it shouldn't depend on nobody discovering the URL. What should you use instead? If you actually need a website where only certain people can access it, there are a few better options. Cloudflare Pages + Cloudflare Access This is probably the first option I'd look at for a small project. You can deploy the static site normally and put Cloudflare Access in front of it. Access can require users to authenticate before they reach the site. For example, you can allow specific email addresses or an entire email domain. That gives you the thing GitHub Pages is missing here: an actual access-control layer in front of the site. Vercel or Netlify If you're already using Vercel or Netlify, their protection and preview features can also make sense. The exact features available depend on the plan, so I'd check the current pricing and feature list before choosing one specifically for authentication. Host it yourself You can also keep it simple and host the site yourself. A small VPS with nginx and basic authentication is enough for many internal sites. It requires more setup and maintenance, but at least you have direct control over how access is handled. Or just don't deploy it This is an option that's easy to overlook. If the site is something you're only using yourself, you might not need to put it on the internet at all. Most static-site generators can run a local development server, so you can just run the site on your machine when you need it. Sometimes that's the simplest solution. The thing I wish I'd known earlier The main takeaway for me was pretty simple: A private GitHub repository and a private GitHub Pages website are two separate things. Making the repository private protects your source code. It doesn't automatically protect the website generated from that repository. So before putting something on GitHub Pages, ask yourself which one you're actually trying to protect. If you only need to hide the source code, a private repository may be enough. If you need to restrict who can access the website itself, you'll need a service that provides authentication/access control or GitHub Enterprise Cloud under the specific Pages setup that supports it. That distinction is easy to miss, and it's much better to find it out before you've accidentally published something you meant to keep private. Top comments (0)