# Ensure Vercel project has password protection configured for deployments

- Source: https://support.icompaas.com/support/solutions/articles/a_1790262000637477-ensure-vercel-project-has-password-protection-configured-for-deployments
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Vercel cloud](https://support.icompaas.com/support/solutions/c_1790103019086234) › [Vercel checks](https://support.icompaas.com/support/solutions/folders/f_1790103034130491)
- Last updated: 2026-09-24
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

**Description**

Ensure Password Protection is enabled on projects whose deployments must stay private but need to be shared with people who do not have Vercel accounts, such as clients or external testers. The password should be strong, stored securely, and changed regularly.

**Rationale**

Password Protection places a password check in front of every request before the application runs. It is the right control when outside users need access and cannot use Vercel Authentication. A weak or widely shared password, or a scope that leaves the production domain open, weakens this protection and can expose content that was meant to stay private.

**Impact**

-   Visitors must enter a password to view deployments
    
-   Allows safe sharing with external users
    
-   Costs $20 per month per protected project on Pro
    

**Default Value**

By default, Password Protection is disabled. It is not available on Hobby, costs $20 per month per protected project on Pro, and is included on Enterprise.

**Pre-Requisites**

-   Team Owner or Member role, or Project Administrator
    
-   Pro or Enterprise plan
    
-   A secure place to store the password
    

**Test Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  In the Password Protection section, verify that it is enabled with the correct scope.
    
6.  If it is disabled or the scope is wrong, follow the implementation steps.
    

**Implementation Steps**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  In the Password Protection section, use the toggle to turn it on. On Pro, select Enable and Pay if prompted.
    
6.  Select Standard Protection or All Deployments, and enter a strong password.
    
7.  Select Save.
    

**Backout Plan**

1.  Sign in to Vercel at [https://vercel.com](https://vercel.com/).
    
2.  Select your team from the team switcher.
    
3.  Select the project from the dashboard.
    
4.  Open Deployment Protection (Security > Deployment Protection in the project sidebar, or Settings > Deployment Protection on older dashboards).
    
5.  In the Password Protection section, use the toggle to turn it off.
    
6.  Select Save.
    

**Reference**

-   [https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/password-protection](https://vercel.com/docs/deployment-protection/methods-to-protect-deployments/password-protection)
    
-   [https://vercel.com/docs/deployment-protection/usage-and-pricing](https://vercel.com/docs/deployment-protection/usage-and-pricing)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.