Description

Ensure Password Protection is enabled on projects whose deployments must stay private but need to be shared with people who do not have Vercel accounts, such as clients or external testers. The password should be strong, stored securely, and changed regularly.

Rationale

Password Protection places a password check in front of every request before the application runs. It is the right control when outside users need access and cannot use Vercel Authentication. A weak or widely shared password, or a scope that leaves the production domain open, weakens this protection and can expose content that was meant to stay private.

Impact

  • Visitors must enter a password to view deployments

  • Allows safe sharing with external users

  • Costs $20 per month per protected project on Pro

Default Value

By default, Password Protection is disabled. It is not available on Hobby, costs $20 per month per protected project on Pro, and is included on Enterprise.

Pre-Requisites

  • Team Owner or Member role, or Project Administrator

  • Pro or Enterprise plan

  • A secure place to store the password

Test Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).

  5. In the Password Protection section, verify that it is enabled with the correct scope.

  6. If it is disabled or the scope is wrong, follow the implementation steps.

Implementation Steps

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).

  5. In the Password Protection section, use the toggle to turn it on. On Pro, select Enable and Pay if prompted.

  6. Select Standard Protection or All Deployments, and enter a strong password.

  7. Select Save.

Backout Plan

  1. Sign in to Vercel at https://vercel.com.

  2. Select your team from the team switcher.

  3. Select the project from the dashboard.

  4. Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).

  5. In the Password Protection section, use the toggle to turn it off.

  6. Select Save.

Reference