Can GitHub Pages Be Private? Private Repos vs Sites (2026)

Yes and no. A GitHub Pages site can be built from a private repository on GitHub Pro, Team or Enterprise, but the site itself is still public on the internet. Restricting who can view the site needs GitHub Enterprise Cloud and an organization account.

So "private GitHub Pages" is two questions with two answers. Below: which plan covers which, what it costs (checked November 2026), why the popular workarounds leak, and what works without Enterprise.

Private repo or private site? The two meanings of "private GitHub Pages"

This is the part that trips people up. A private repo hides your source code. A private site hides the pages. GitHub sells them on very different plans, and it's easy to assume one gets you the other.

GitHub's own docs are blunt about it: "GitHub Pages sites are publicly available on the internet, even if the repository for the site is private (if your plan or organization allows it)."

Pro is no longer listed on github.com/pricing, so check your billing settings for its current price. No Enterprise? Skip to the workarounds.

GitHub Pages from a private repo: which plans allow it

Here's GitHub's "who can use this feature" line, word for word: "GitHub Pages is available in public repositories with GitHub Free and GitHub Free for organizations, and in public and private repositories with GitHub Pro, GitHub Team, GitHub Enterprise Cloud, and GitHub Enterprise Server."

Quick version:

• On Free, the repo must be public. Make it private and GitHub takes the site down. Our HTML hosting guide covers the public setup.
• On Pro or Team, the repo can be private and the site keeps running, publicly.
• If a paid plan lapses or you downgrade, your GitHub Pages private repo stops serving the site. The error people report in the GitHub Community starts: "Your billing plan does not support private pages." The fix it offers: make the repo public, or upgrade.

The part the docs skip over: a private repo only hides what isn't published. Anyone can download the built output, from HTML and JavaScript bundles to JSON files and leftover source maps. Check for source maps and API keys before trusting "private repo" with anything.

Can you use a private repo with GitHub Pages for free?

Not directly. On Free, the repo that serves the site must be public, but the source can live in a second, private repo. That's the forum-favorite trick:

1. Keep the source in a private repo.
2. Add a GitHub Actions workflow there that builds the site and pushes the built files to a public repo, such as username.github.io.
3. Give the workflow write access to the public repo with a deploy key or a token.

The deploy step looks roughly like this, using the community action peaceiris/actions-gh-pages:

- name: Push the build to the public Pages repo
  uses: peaceiris/actions-gh-pages@v4
  with:
    deploy_key: ${{ secrets.ACTIONS_DEPLOY_KEY }}   # private half of a deploy key
    external_repository: username/username.github.io # public repo that serves the site
    publish_branch: main
    publish_dir: ./dist                              # your build output folder

The private half of the key goes into the source repo's secrets as ACTIONS_DEPLOY_KEY. The public half goes into the public repo's deploy keys, with write access. Two easy-to-miss bits: the step goes after your checkout and build steps, and in the public repo, Settings > Pages has to deploy from the main branch.

Know what this buys you. The built site and its repo stay public. It hides your source, a paid theme or your drafts, and that's it.

A private site: privately published Pages on GitHub Enterprise Cloud

This is GitHub's real answer, and it's narrow. From the docs: "To publish a GitHub Pages site privately, your organization must use GitHub Enterprise Cloud." And: "A privately published site can only be accessed by people with read access to the repository the site is published from."

The rules:

• Organization accounts only. GitHub staff told individuals in discussion #44555 that "The feature you are after is not available to individuals."
• Project sites only, from private or internal repos the organization owns. An organization site (org.github.io) can't be private.
• A unique subdomain. Private sites live on a *.pages.github.io address shown in Settings > Pages. You can add a custom domain.
• Enterprise Managed Users can only publish private sites, visible to enterprise members.
• Org owners decide whether members may publish public sites, private sites, both or neither.

To turn it on: open the repo, go to Settings > Pages, open the visibility dropdown and choose Private, then hit Visit site. Changes can take up to 10 minutes to show up.

GitHub's changelog video pitches it as a way to "host internal documentation and knowledge bases", and the page inherits the repo's permissions. That's where the cost hides. Every viewer needs a GitHub account with read access to the repository, and GitHub's billing docs count outside collaborators on private repos as license users. So each outside viewer takes an Enterprise seat. At the list price of $21 per user per month, a five-person client team would add about $105 a month. Great for a company already on Enterprise. A poor fit for a client preview or a docs site for a handful of outside reviewers. There's a 30-day Enterprise trial if you want to test it.

Why Cloudflare Access or a JavaScript password in front of GitHub Pages isn't private

These two show up in every thread. Neither holds up.

Cloudflare Access in front of a GitHub Pages custom domain. Access only checks visitors who come through Cloudflare. GitHub's servers still answer for your domain if someone asks them directly, so the login is an invisible wall you can walk around. And on GitHub Free the repo is public anyway, so the files are on github.com for anyone to browse.

A JavaScript password snippet. The password and the page are both in the source. When someone suggested one in discussion #44555, a GitHub staff member replied that client-side code "is not providing you any security."

StatiCrypt is a different animal. It encrypts the page itself, so it holds up on GitHub Pages with a long passphrase, but there's one shared password, no way to revoke one person, and images and PDFs stay unencrypted. The details are in our guide to password protecting a website.

Ways to get a private static site without Enterprise

If the goal is "only these people can see the site", use a host that checks visitors before it sends a page. Prices checked November 2026:

Easy-to-miss Cloudflare gotcha: the access-policy toggle in a Pages project "will only protect your preview deployments", per Cloudflare's docs. The *.pages.dev address and your custom domain need their own Access setup.

Netlify and Vercel plans get more detail in the Netlify Drop alternatives and Vercel alternatives roundups. Moving the whole site? The GitHub Pages alternatives roundup compares hosts, and the GitHub Pages password protect walkthrough moves a Pages site behind a password step by step.

GitHub Pages limits to know before you pick

From GitHub Docs, checked November 2026:

• One user or organization site per account.
• Source repos have a recommended limit of 1 GB, and published sites may be no larger than 1 GB.
• Deployments time out after 10 minutes.
• A soft bandwidth limit of 100 GB per month.
• A soft limit of 10 builds per hour, which doesn't apply if you publish with a custom GitHub Actions workflow.
• Not for running an online business, and "sites shouldn't be used for sensitive transactions like sending passwords or credit card numbers."

So even GitHub doesn't want private data on a public Pages site.

Hosting a private static site on Hostsmith

Hostsmith hosts the live site, and Private Sites decides who gets in. You upload the built site, so there's no repository on the host and your source never goes public. Drop your zipped folder on the dashboard, or deploy from your own CI with the API: a step in your existing GitHub Actions workflow that calls the Hostsmith API or JS SDK.

Then switch on Private Sites: a shared password, or an email whitelist where each reviewer is added or removed by email. Visitors don't need a GitHub account or a seat.

Plan notes:

• Starter ($5/month billed yearly, $9 monthly) includes Private Sites, 1 site and 50 MB of storage.
• Pro ($15/month billed yearly, $21 monthly) adds 5 sites, 500 MB, custom domains, and room for a live site plus a protected staging copy.
• Check your build folder's size first: under 50 MB fits Starter, 50 to 500 MB needs Pro, and Agency goes up to 10 GB.
• The Free plan doesn't include Private Sites. Current prices: hostsmith.net/#pricing.

Agencies can use the same gate for a client preview before launch.

Frequently Asked Questions

Do GitHub Pages have to be public?

The site does, unless your organization is on GitHub Enterprise Cloud and publishes it privately. The repo only has to be public on GitHub Free.

Can someone see my private GitHub repository?

Not the repo. They can download everything the Pages site publishes, scripts and source maps included.

Is GitHub Pages free?

Yes, for public repos on GitHub Free. Publishing from a private repo needs Pro (about $4 a month) or Team ($4 per user per month), and a private site needs Enterprise Cloud ($21 per user per month), checked November 2026. Soft limits apply, and running an online business on it isn't allowed.

Do GitHub Pages still work?

Yes. If yours went down after the repo went private or a plan lapsed, that's the "billing plan does not support private pages" error. Make the repo public again or upgrade.

Can I make my github.io user site private?

No. Private visibility is only for project sites owned by an organization on Enterprise Cloud.

So: a private repo is easy to get, a private site on GitHub is an Enterprise feature, and for a handful of viewers a host that checks visitors at the door is the shorter path. If that's where you're headed, the password protect an HTML page walkthrough takes you from a built site to a protected link.