# Ensure Vercel project has deployment protection enabled on production deployments

- Source: https://support.icompaas.com/support/solutions/articles/a_179026200025092-ensure-vercel-project-has-deployment-protection-enabled-on-production-deployments
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure projects whose production site must not be public, such as internal tools, admin dashboards, and sites not yet launched, use Vercel Authentication with the All Deployments option, so that the production domain and all generated URLs require a Vercel login.

**Rationale**

Standard Protection keeps preview URLs private, but the production domain stays open to everyone. For internal or unreleased applications, this means anyone on the internet can reach the production site. Selecting All Deployments protects every URL of the project, including production, and is now available at no extra cost on every plan.

**Impact**

-   The production domain requires a Vercel login
    
-   Only users with project access can open the site
    
-   Not suitable for public websites
    

**Default Value**

By default, new projects use Standard Protection, which leaves the production domain public. All Deployments is available on every plan at no additional cost.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    
-   Confirmation that the production site should not be public
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  Verify that Vercel Authentication is enabled with All Deployments selected.
    
6.  Open the production domain in a private browser window and confirm the Vercel login page appears.
    
7.  If the production domain is public and should not be, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  Enable Vercel Authentication and select All Deployments from the dropdown.
    
6.  Select Save.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  Select Standard Protection from the dropdown.
    
6.  Select Save.
    

**Reference**

-   [https://vercel.com/docs/deployment-protection](https://vercel.com/docs/deployment-protection)
    
-   [https://vercel.com/changelog/protect-production-deployments-for-free-on-every-plan](https://vercel.com/changelog/protect-production-deployments-for-free-on-every-plan)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.