Staging site publishes publicly despite workspace label and missing password protection warning

Question

When a new site is created in Webflow and marked as "Staging" in the workspace, the designer does not automatically enable Site Password Protection, and publishing the site proceeds without any warning that the toggle remains off. This can result in the site being publicly accessible via its Webflow subdomain or custom domain, exposing draft or staging content unintentionally. The product team has not yet decided whether the default behavior should change to protect Staging sites by default or to require an explicit confirmation before publishing when password protection is disabled.

What should be the default privacy setting for sites labeled Staging in Webflow? Should Webflow display a mandatory warning when attempting to publish a site with password protection turned off? Should workspace settings enforce automatic password protection for new Staging sites?

Tasadduq Burney · Answer

Current confirmed behavior: a Webflow workspace label of "Staging" is organizational only. It does not automatically enable site-wide password protection, and publishing proceeds without a mandatory warning when the password protection toggle is off. A Staging site can therefore be publicly accessible via its Webflow subdomain or a connected custom domain.

Confirmed facts

Staging label does not enforce password protection.
Publish action does not require a mandatory confirmation when password protection is disabled.
Workspace settings do not automatically enforce password protection for new Staging sites; configuration is manual.
Behavior may vary by plan tier, account type, and recent platform updates. Findings reflect knowledge up to 2024 and may be outdated.

Likely explanation

The product team has not established a default privacy policy for Staging sites. The label is used for project organization and billing grouping, not for access control. Password protection remains a per-site visibility setting that must be turned on manually in Site Settings > Password protection.

Steps needed for this case

Open the site in the Webflow Designer and check Site Settings > Hosting > Password protection. Note the toggle state before publishing.
Publish to the Webflow subdomain and verify in an incognito window whether a password prompt appears.
If public exposure must be avoided, enable password protection and set a password before publishing. For teams, document the password in workspace notes.

One diagnostic detail that changes the recommendation: is the site using a default webflow.io subdomain or a connected custom domain? Custom domains can be removed or paused at the registrar level for additional isolation, while webflow.io subdomains rely solely on the site's password protection setting.

Staging site publishes publicly despite workspace label and missing password protection warning

1 answer

Confirmed facts

Likely explanation

Steps needed for this case

Your perspective belongs here.

0 question comments