# Ensure Vercel project has deployment protection enabled on preview deployments

- Source: https://support.icompaas.com/support/solutions/articles/a_1790261997687975-ensure-vercel-project-has-deployment-protection-enabled-on-preview-deployments
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure the project has Deployment Protection turned on with Vercel Authentication, using Standard Protection or All Deployments, so that preview deployments and generated deployment URLs can only be opened by logged-in Vercel users who have access to the project.

**Rationale**

Preview deployments are built from branches and pull requests and often contain unreleased features, test data, debug output, and connections to non-production systems. Without protection, anyone who finds or guesses a preview URL can open it. Protecting previews keeps unfinished work private and reduces the chance of leaking sensitive information.

**Impact**

-   Preview URLs require a Vercel login
    
-   Prevents public access to unreleased work
    
-   Code that fetches VERCEL\_URL may need updating
    

**Default Value**

By default, new projects use Vercel Authentication with Standard Protection, which protects preview deployments. Protection can be turned off per project.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  Verify that Vercel Authentication is enabled.
    
6.  Verify that Standard Protection or All Deployments is selected, not a Legacy option.
    
7.  Open a preview URL in a private browser window and confirm the Vercel login page appears.
    
8.  If previews are not protected, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  Enable Vercel Authentication.
    
6.  Select Standard Protection or All Deployments.
    
7.  Select Save.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  Select the previous option, or disable Vercel Authentication.
    
6.  Select Save.
    

**Reference**

-   [https://vercel.com/docs/deployment-protection](https://vercel.com/docs/deployment-protection)
    
-   [https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/vercel-authentication](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/vercel-authentication)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.