Make Pre-Launch Sites Private by Default and Drop the $150 Add-On

You are about to ship a pre-launch site, an internal tool, or a private dashboard on Vercel, and you do not want strangers reading it before launch. The old habit was to leave every preview open, then patch the problem after someone finds it. The better habit is to start from the side that protects your time. Vercel Authentication can now protect every deployment in a project, including production, at no extra cost on any plan. Before the change, production-domain protection required the Advanced Deployment Protection add-on at $150 per month. The durable trick is to protect the whole project, open only the previews that must be public, and stop paying for protection you no longer need.

Private by default protects the hours

When turned on, visitors need a Vercel account with project access before they can view it. That gives you a quiet default for dashboards, internal tools, and half-finished pages. You do not need to chase accidental shares or explain why a pre-launch URL is open. The URL stops being a public surface, and the work stays in the place where it belongs: behind the people who need it.

The access rule also changes the way you think about deploys. A new route, dashboard, or internal tool does not become a public page, shared link, or support target automatically. The default keeps the work in the project until you decide a specific preview should leave it.

For a solo operator, the hours matter more than the dollars. A private default removes the small decisions that pile up: who can see the staging page, whether a screenshot is safe, whether a deploy accidentally exposed a route. You spend less time fixing trust and more time shipping. Margin includes the line item you delete and the time you keep from becoming a support queue, a permissions list, or a late-night audit.

Treat the default as a boundary. A pre-launch project has more moving parts than a marketing page: internal tools, staging routes, half-finished dashboards, and links that only make sense to the person who shipped them. Default private keeps those parts out of the general circulation.

Open only the previews that need air

The exceptions feature for Deployment Protection is now offered without a charge on all plans. An exception lets a specific preview domain stay public while the other deployments in the project remain protected. Use this checklist in order. Protect first, then open only what must be public.

• Turn on project-wide sign-in.
• Confirm production is covered, not just preview URLs.
• Remove the paid protection add-on from your budget.
• Add an exception only for a preview domain that must be public.
• Keep the other deployments protected after the exception is added.
• Open the public preview and confirm it loads without sign-in.

A public preview is useful when someone outside the project needs to see the work. The exception should be narrow enough that you can name the reason. The exception is a door with a name. A stranger can see the page only when it must be public. A named person should get access, not a public URL. That keeps the exception list short and the public preview easy to defend.

Answer one question before you open the preview: who is this for, and why does it need to be seen without access? If the answer is a public preview, let it breathe. A short exception list is easier to defend than a long one. If you find yourself adding exceptions for every deploy, stop and return to the default. The default is the part of the system that does not need your attention. The exceptions are the part that should get a second look before you ship.

Drop the add-on and keep the margin

The paid add-on is not needed for the default setup. If you need password protection, Pro teams can purchase Password Protection for individual projects at $20 per project per month. That is a separate decision. Use it for teams that want password protection, and keep the default-private habit as the working rule. Keep the paid option on the shelf until a real project needs it, and keep the default doing the quiet work.