--- title: "Vercel Deployment Protection, Cloudflare Access or a Netlify Password: Which Should You Use?" slug: /blog/vercel-deployment-protection-vs-cloudflare-access publishedAt: "2026-10-20" updatedAt: "2026-10-20" author: ott description: "Which site-protection feature to pick on Vercel, Netlify or Cloudflare, with plan gates, prices and setup mistakes. Checked on each vendor's own docs and pricing pages on 20 October 2026." --- # Vercel Deployment Protection, Cloudflare Access or a Netlify password: which should you use? > **TL;DR:** Use Vercel Authentication if everyone who needs access has a Vercel account on your team. Use Vercel Password Protection or a Netlify password when a small group can share one secret. Anyone with the secret gets in. Use Cloudflare Access when you need a rule for each person, by email or identity provider. You must then configure every hostname, including `pages.dev` and previews. To protect a report, a plan or a prototype instead of an application, use Display (display.dev). Display is the docs workspace for agents and people. You publish the file and invite people by email. They open it with a one-time password (OTP) or company sign-in. Display is our product. This page says where it does not fit. We checked the plan gates, prices and settings below on the Vercel, Netlify, Cloudflare and Display pages on 20 October 2026. Vendors change them. Open the linked page before you decide. --- ## Decision table: who needs access, what you protect | Who must get in | What you protect | Pick | | ---------------------------------------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------- | | Your own team, all with Vercel accounts | A Vercel project | Vercel Authentication (on every plan) | | Your own team, all on Netlify | A Netlify project | Netlify Private project visibility | | A few people who can share one secret | A site on Vercel Pro or Netlify Pro | Vercel Password Protection ($20 a month for each project) or a Netlify password | | Specific readers without accounts on your host, with removal for each person | A site on Cloudflare Pages or any host behind Cloudflare | Cloudflare Access with email PIN or an identity provider | | Fixed office or VPN addresses | Production on Vercel Enterprise | Vercel Trusted IPs | | Specific readers or your whole company | One report, plan, prototype or Markdown file | Display | --- ## Feature table | Option | Plan needed | Price (20 Oct 2026) | Access for each person | Previews covered | Production covered | Custom domain covered | Outside guests | | ---------------------------------------- | -------------------------------------------------------- | ---------------------------------------------------------------------------- | -------------------------------------------------------- | -------------------------------------------------------------------------- | -------------------------------------------------------------------- | -------------------------------- | ---------------------------------------------------------- | | **Vercel Authentication** | All plans | Included | Yes, for Vercel users with access to the team or project | Yes | Yes, with "All Deployments" | Yes, with "All Deployments" | Only people with a Vercel account. They can request access | | **Vercel Password Protection** | Pro or Enterprise | $20 a month for each protected project on Pro. Included on Enterprise | No. One shared password | Yes | Yes, with "All Deployments" | Yes, with "All Deployments" | Anyone with the password | | **Vercel Trusted IPs** | Enterprise | Included on Enterprise | No. By IP address | Your choice of scope. "Only Production Deployments" leaves previews public | Yes | Yes | Only from allowed IP addresses | | **Netlify password** | Pro (credit-based), Enterprise, legacy Pro | Pro is $20 a month with unlimited members | No. One shared password | Yes | Yes, or leave production open ("Previews only") | Yes | Anyone with the password | | **Netlify Private project** | All credit-based plans. Team-login options on Enterprise | Free and Personal: only the team owner can view. Pro: unlimited team members | Yes, for Netlify team members | Yes | Yes | Yes | No. Visitors must be on your Netlify team | | **Cloudflare Access, email PIN** | Free plan or above | $0 up to 50 users. Pay-as-you-go is $7 per user a month, billed annually | Yes, by email address or domain | Only when you turn on the Pages setting | Not with the Pages setting. Needs a change to the Access application | Needs its own Access application | Yes. Any address that your policy allows | | **Cloudflare Access, identity provider** | Free plan or above | Same as above | Yes | Same | Same | Same | Yes, if the provider and policy allow | | **Display** | Any plan for OTP. Pro for Google and Microsoft sign-in | Free €0 (3 gated artifacts). Solo €15. Pro €49. No fee for each viewer | Yes | Not applicable. You publish a file, not a build | Yes | Enterprise, by contract | Yes. Invited readers use an OTP | The sources are at the end of this page. --- ## Short setup for each option ### Vercel Authentication 1. Open the project, then **Settings**, then **Deployment Protection**. 2. Turn on **Vercel Authentication**. 3. Choose the scope. "Standard Protection" protects all deployments except production domains. "All Deployments" protects production too. 4. Select **Save**. Read the [Vercel guide](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/vercel-authentication). People without a Vercel login cannot get past it, unless you give them a Shareable Link. ### Vercel Password Protection 1. Open **Deployment Protection** in the project settings. 2. Turn on **Password Protection**, choose the scope, enter a password and select **Save**. 3. Expect a charge of $20 a month for that project on Pro. Read the [Vercel guide](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/password-protection). ### Netlify password or Private project 1. Go to **Project configuration**, **General**, **Visitor access**. 2. On a credit-based plan, open **Project visibility** and choose **Password** (Pro only) or **Private**. 3. On a legacy plan, open **Password Protection** and choose basic password protection or team login protection. 4. Choose whether production stays open. Select **Save**. Read the [Netlify guide](https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/) and our [Netlify walkthrough](/netlify-password-protection-alternative). ### Cloudflare Access for a Pages site 1. In Zero Trust, go to **Integrations**, **Identity providers** and add **One-time PIN**. New Zero Trust organizations do not get it automatically. 2. In the Pages project, open **Settings**, **General** and select **Enable access policy**. This step covers preview deployments only. 3. To cover the production `pages.dev` address, open the Access application. Under **Public hostname**, delete the wildcard (`*`) in the **Subdomain** field and save. Then select **Enable access policy** in the Pages project again to protect previews. 4. For a custom domain, create a separate self-hosted Access application for that hostname. 5. Add an **Allow** policy with the emails or the email domain that you want. Read the [Pages preview guide](https://developers.cloudflare.com/pages/configuration/preview-deployments/), the [Pages known issues](https://developers.cloudflare.com/pages/platform/known-issues/), the [one-time PIN guide](https://developers.cloudflare.com/cloudflare-one/identity/one-time-pin/) and [Access policies](https://developers.cloudflare.com/cloudflare-one/policies/access/). Cloudflare sends a PIN only to an address that a policy allows. The PIN expires after 10 minutes and works once. ### Display 1. Connect Display to your agent. Read [Publish with your agent](/docs/publish-with-agent). 2. Ask the agent: "Publish report.html to Display as Private and share it with [alice@client.com](mailto:alice@client.com)." 3. Or ask it to publish the file for your company. --- ## Setup mistakes to check for **The Cloudflare Pages setting does not cover production.** The Pages setting "Enable access policy" protects preview URLs. Cloudflare's docs say that it does not protect the `*.pages.dev` domain or a custom domain. Open the production URL in a private window to check. **A custom domain on Cloudflare needs its own Access application.** Protect `*.pages.dev` first. Then create a separate application for the custom domain. Without it, the Access login page opens but does not let your visitors in. **Vercel "Standard Protection" leaves production open.** This scope protects preview and generated URLs. Your production domain stays public. Choose "All Deployments" if production must be private. **Vercel bypass links and secrets open the door.** A Shareable Link lets anyone who has it view the deployment. The Protection Bypass for Automation secret skips Password Protection, Vercel Authentication and Trusted IPs. It also skips Vercel's bot protection challenges. Keep the secret as safe as a password, and revoke links that you no longer use. **You cannot take a shared password away from one person.** On Vercel and Netlify, you must change the password for everyone to stop one reviewer. Vercel says that visitors must enter a changed password again. **A Netlify Private project admits only your team.** Every outside reader must join your Netlify team. On Free and Personal, only the team owner can view a private project. --- ## When the host is too much Host protection answers one question: who can load this site? That fits an application. For one HTML report, a plan or a prototype, it adds work. You need a project, a deploy, a Cloudflare application or a paid add-on for each project. Display protects a file, not a site. You publish HTML or Markdown, choose Private or Company, and invite people. Invited readers outside your company open the file with an OTP sent to their email. They need no Display account. On Pro, colleagues sign in with Google or Microsoft. Pro costs €49 a month and has no fee for each viewer. What Display does not do: - It has no shared password and no expiring links. - It publishes one HTML or Markdown file for each artifact. Publishing a directory or a ZIP file is planned. - It does not run application code, builds or functions. - Outside guests can view an artifact. They cannot comment yet. - Custom domains and SAML are on Enterprise, by contract. Self-serve SAML is planned. --- ## When another option is better - **You deploy an application on Vercel or Netlify.** Use the platform's own protection. Display does not host applications. - **You need Zero Trust beyond one site.** Cloudflare Access covers devices, networks and many applications. It is free up to 50 users. - **You need a shared password today and nothing more.** Vercel Password Protection or a Netlify password is the quicker choice. - **Your company has no more than 50 readers and an engineer who knows Cloudflare.** Access is free. Display's value there is less setup, not a lower price. --- ## FAQ ### Does Vercel Authentication let outside clients view a preview? Only if they have a Vercel account and you give them access. Vercel's docs say that a Hobby plan allows one external user for each account. For clients without Vercel accounts, use a Shareable Link, a password or a different tool. ### How much does Vercel Password Protection cost? On Pro, it costs $20 a month for each protected project. Enterprise includes it, and Hobby does not have it. Pro teams on the legacy Advanced Deployment Protection package pay $150 a month for each team. Vercel Authentication is on every plan. Vercel's SAML single sign-on costs $300 a month on Pro. Checked 20 October 2026 on vercel.com/pricing and the Deployment Protection docs. ### Does Netlify have a free password feature? Not on the credit-based Free and Personal plans. Netlify offers a shared password on Pro, and the full set of password and team-login options on Enterprise. Checked 20 October 2026. ### Is Cloudflare Access free? Yes, for up to 50 users. Above that, Cloudflare lists pay-as-you-go at $7 per user a month, billed annually. Checked 20 October 2026 on the Access product page. ### Can I put Cloudflare Access on a Vercel or Netlify site? Yes, if the site's hostname runs through your Cloudflare account and you create an Access application for it. Then the host's own protection and Access can both apply. Test the host's default URL too, because visitors can still open it on its own domain. ### Which option gives a record of who opened the page? Cloudflare Access logs each login attempt with the user's email. Display shows the people who have a page open now, with a Guest label for outside people. Display Pro shows viewer identity in viewer statistics and keeps audit logs for 90 days. A shared password gives no record for each person. ### What is the simplest private link for one report? Publish it on a service that checks the identity of each reader. On Display, ask your agent: "Publish report.html as Private and share it with [alice@client.com](mailto:alice@client.com)." The URL opens only for the invited address. --- ## Sources Checked 20 October 2026: - Vercel: [Deployment Protection](https://vercel.com/docs/deployment-protection), [Vercel Authentication](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/vercel-authentication), [Password Protection](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/password-protection), [Protection Bypass for Automation](https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/protection-bypass-automation), [Shareable Links](https://vercel.com/docs/deployment-protection/methods-to-bypass-deployment-protection/sharable-links), [Pricing](https://vercel.com/pricing) - Netlify: [Password protection](https://docs.netlify.com/manage/security/secure-access-to-sites/password-protection/), [Pricing](https://www.netlify.com/pricing/) - Cloudflare: [Access product page](https://www.cloudflare.com/zero-trust/products/access/), [Pages preview deployments](https://developers.cloudflare.com/pages/configuration/preview-deployments/), [Pages known issues](https://developers.cloudflare.com/pages/platform/known-issues/), [One-time PIN](https://developers.cloudflare.com/cloudflare-one/identity/one-time-pin/), [Access policies](https://developers.cloudflare.com/cloudflare-one/policies/access/) - Display: [Plans and limits](/docs/limits), [Sharing and access](/docs/visibility), [Sign-in methods](/docs/auth-providers), [Pricing](/pricing) **Related:** - [Vercel alternative](/vercel-alternative) - [Cloudflare Access alternative](/cloudflare-access-alternative) - [GitHub Pages vs Cloudflare Pages for internal docs](/blog/github-pages-vs-cloudflare-pages-internal-docs) - [How to password-protect an HTML file](/blog/password-protect-html-file)