Netlify Makes New Projects Private by Default, Not Existing Ones

Netlify flipped a default that has held since the company launched: new projects on Credit-based plans no longer deploy straight to a public URL. Starting July 28, 2026, every new team on a Free, Personal or Pro plan gets projects private by default, nothing accessible outside the team until someone explicitly makes it public (KP, Netlify Head of Community, on X, July 2026).

What changed

Netlify’s project visibility setting now has a team-level default: Team settings > General > Visitor access > Default project visibility. When private-by-default is on, every new project, including deploy previews, branch deploys and agent run previews, stays visible only to the team until someone flips it public (Netlify Docs). On Free and Personal plans, a private project is visible only to the team owner; Pro plans can invite unlimited team members to see it (Netlify Docs).

The setting only applies to Credit-based plans. Legacy pricing, Enterprise and Open Source plans don’t have it at all.

Who actually gets it

The release only applies to new teams, though, not a retroactive fix for existing ones. Teams that signed up before July 28 keep the old behavior: every project URL stays publicly reachable unless the team already set up password protection or another access control, and private-by-default has to be turned on by hand in team settings (Netlify Docs).

That split matters because of who Netlify says the change is for. KP’s announcement frames it around a shift in what gets deployed, not just who deploys it: prototypes, internal tools, early client work and projects scaffolded by coding agents, work that’s often a draft rather than something meant for a public audience the moment it builds (KP on X). An agent that scaffolds a project end to end doesn’t stop to ask whether the deploy should be public, and until now Netlify’s own default answered “yes” every time.

Why it’s overdue

Public-by-default made sense when Netlify’s whole pitch was “drag a folder, get a URL” and deploying was the hard part. It stops making sense once deploying is nearly free and agents can spin up projects faster than a human can think to lock one down. A private default doesn’t just save an embarrassing screenshot, it closes an exposure path: an internal tool or a client’s early-stage app with real data in it, shipped from a template nobody thought to gate.

Our take: shipping this for new teams only is the safe rollout, not the complete fix. Flipping the default retroactively would break existing integrations that assume a public URL, so Netlify’s caution is reasonable engineering. But it also means the accounts most likely to have accumulated stray public prototypes, the ones that have been on Netlify long enough to build up a backlog, are exactly the accounts this change doesn’t touch. If you opened your Netlify team before July 28, the fix is one settings toggle away. Flip it rather than waiting for Netlify to do it for you.