Site-wide Password Protection vs. Folder-level Access for Private Content

Managing Private Content Visibility

Webflow provides multiple mechanisms to prevent accidental public access to staging or private project areas. When a site requires a mix of public-facing marketing pages and restricted internal content, the choice of access control impacts both user experience and security.

Site-wide password protection gates the entire project, including the staging domain, ensuring no content is visible without authentication. Conversely, folder-level password protection allows specific directories to be locked while leaving the rest of the domain open for search engine indexing and public traffic.

The primary constraint is maintaining a public SEO presence while ensuring that sensitive internal pages remain inaccessible to anyone without a password, regardless of whether they have the direct URL.

• Does site-wide protection override folder-level settings if both are configured?
• Which approach is more effective for preventing accidental leaks on the webflow.io staging domain?