How do I stop Codex publishing to ChatGPT Sites?

Add a Publishing block to `AGENTS.md`. The block tells Codex not to create Sites unless the task names them, and names Display as the publish target. Do not use the word "website" for a document. On Enterprise, an admin can also limit who creates Sites.

Does Codex publish to Sites by default?

OpenAI does not document that. It documents two triggers: the word "website" and `@Sites`. Name the target in `AGENTS.md`.

Does AGENTS.md work in every Codex surface?

OpenAI documents that Codex reads `AGENTS.md` when it starts and builds the instruction chain once for each run. If the instructions seem old, start Codex again. We did not test every surface.

Can I publish a folder from Codex to Display?

Not yet. Display publishes one HTML or Markdown file at a time. Publishing a directory or a ZIP file is on the roadmap. Ask Codex for one self-contained HTML file.

What are the ChatGPT Sites usage limits?

Plus and Pro have no fixed limit on the number of Sites. Usage and storage limits apply, and each Site can have a database of up to 10 GB.

Can people outside my company open what Codex publishes to Display?

Yes. Invite them by email address. They enter a one-time password and create no account. They can read the page. They cannot comment or edit it yet.

How to Stop Codex Publishing to ChatGPT Sites

Display is our product. We checked the OpenAI facts against the Codex documentation and the OpenAI Help Center on 16 October 2026.

The short answer

Put this in the AGENTS.md at the root of your repository:

## Publishing
 
- Do not create or publish a ChatGPT Site unless the task names Sites.
- Keep previews local. Run a dev server and give the localhost address.
- To share a report, plan, dashboard or prototype, publish the HTML or
  Markdown file to Display for the company.
- To change something already published, update the page at the same link.
  Read the current version first. Do not publish a new page.
- Report the URL in your final message.

Codex builds its instruction chain once for each run. It reads the global ~/.codex/AGENTS.md first. Then it reads each AGENTS.md from the project root down to your working directory. Files closer to your directory come later and win. At each level, an AGENTS.override.md file replaces AGENTS.md. The combined size has a default limit of 32 KiB. If Codex seems to use old instructions, start Codex again in the target directory.

What OpenAI documents about how Sites starts

The OpenAI Help Center tells you to select Codex in the ChatGPT desktop app. Then you include the word "website" in your prompt, or you mention @Sites. These are the two documented triggers. The words "share" and "publish" are not on that list.

No OpenAI page says that Codex publishes to Sites by default. Some developers report that Codex makes a Site when a task asks for something that people can open. Treat that as unconfirmed. The AGENTS.md block costs nothing and removes the doubt. Also avoid the word "website" in prompts for documents.

Admins have controls too. Business workspaces have Sites on by default. On Enterprise, admins use role-based access control to decide who can create Sites and who can publish them. Public publishing is a separate workspace setting.

Three fixes, in order

Name the target in AGENTS.md. Use the block above. It works wherever Codex reads AGENTS.md.
Ask an admin to limit Sites. On Enterprise, an admin can limit who creates and publishes Sites, and can keep public publishing off.
Connect a publish target. An instruction to publish needs a tool to publish with. Add the Display plugin so that Codex can publish by itself. Complete the browser sign-in when Codex asks. Start a new task so that Codex loads the tools. The full steps, including an API-key setup, are in the Codex setup guide.

Conversation, document or website

Three different things are all called "sharing". Decide which one you made before you pick a tool.

You made a...	It is a...	Where it belongs	Who opens it
Chat with reasoning and results	Conversation	A ChatGPT share link	On a personal account, anyone with the link. On Business and Enterprise, members of the same workspace
Report, plan, specification, dashboard export	Document	A published file: Display, or a Page in a ChatGPT Space	Colleagues and invited people
App with a database, server code or a public product	Website	A ChatGPT Site, Vercel or Netlify	Anyone, or people who sign in to that host

Codex makes all three. The risk is that a document goes to a website host, where readers need a ChatGPT account or the page is public. For a document, publish the file and choose the audience.

How private a Site can be

A new Site opens only for its owner and the workspace admins. The owner can open it to selected users or groups, invited outside viewers, everyone in the workspace, or everyone on the internet. Invited visitors sign in with the account that received access. Invited outside viewers can view only. Availability depends on the rollout. Public publishing is off by default on Enterprise. For the details for each audience, read Can a ChatGPT Site be private?.

At DevDay in late September 2026, OpenAI added ChatGPT Space, which holds Pages, files and Sites. You share Pages with people or Teams, with view or edit access. The pages we read do not say whether readers outside the workspace can open a Page.

Sites usage limits

Plus and Pro have no fixed limit on the number of Sites. Usage and storage limits still apply. Work to build or edit a Site counts toward your Codex usage. Hosting traffic and storage have separate limits. Each Site can have a database of up to 10 GB. If you reach a shared limit, you may not be able to create a new Site.

Display does not limit viewers. Free is €0 with 3 gated artifacts, and viewers are unlimited on every plan. Public artifacts are unlimited, and on Free they show Display branding.

What happens after Codex publishes to Display

Codex returns a URL. You choose who can open it: the public, everyone at your company, or people you invite by email. Colleagues open a company artifact with a one-time password, or on Pro with Google or Microsoft. Invited outside readers use a one-time password.

Reviewers in your organization comment on the page. Codex reads the comments through MCP, changes the file, publishes the next version to the same URL and resolves the thread. A teammate can also select Edit and fix a line in the browser. Read How an agent reads review comments.

When to keep Sites

Keep ChatGPT Sites when Codex builds an application, such as a tracker with saved data, a portal or a dashboard with a database. This fits colleagues who already have ChatGPT seats. Display hosts files and does not run a database. For a public product site with a backend, Vercel or Netlify fit better.

FAQ