Staging site publishes publicly despite workspace label and missing password protection warning

When a new site is created in Webflow and marked as "Staging" in the workspace, the designer does not automatically enable Site Password Protection, and publishing the site proceeds without any warning that the toggle remains off. This can result in the site being publicly accessible via its Webflow subdomain or custom domain, exposing draft or staging content unintentionally. The product team has not yet decided whether the default behavior should change to protect Staging sites by default or to require an explicit confirmation before publishing when password protection is disabled.

What should be the default privacy setting for sites labeled Staging in Webflow? Should Webflow display a mandatory warning when attempting to publish a site with password protection turned off? Should workspace settings enforce automatic password protection for new Staging sites?