GitHub Pages from a Private Repository: Plans and Site Visibility (2026)¶

For / Key Points

For: Anyone who wants to keep a GitHub Pages source repository private or restrict access to the resulting site.

Key points:

GitHub Pro supports Pages from a private personal repository; organizations need GitHub Team or higher
A Pages site is normally public even when its source repository is private
A privately published site requires a GitHub Enterprise Cloud organization and Pages access control

Short answer: repository visibility and site visibility are separate¶

GitHub Pages treats source repository visibility and published site visibility as separate settings. The ability to build from a private repository does not automatically make the website private. ¹²

Goal	Requirement	Site visibility
Publish from a public repository	GitHub Free or higher	Public
Publish from a private personal repository	GitHub Pro or higher	Public by default
Publish from a private organization repository	GitHub Team or higher	Public by default
Limit a site to authorized users	Enterprise Cloud organization and Pages access control	Private

For a public blog or documentation site, a private source repository with a public Pages deployment is often sufficient. For internal documentation, verify the Enterprise Cloud conditions or choose hosting with an authentication layer.

Plan requirements¶

GitHub's plan documentation says that GitHub Free supports Pages in public repositories. GitHub Pro adds Pages for private repositories owned by a personal account, while GitHub Team adds the capability for organization repositories. ¹

Owner	Plan	Private repository as the Pages source
Personal account	GitHub Free	No
Personal account	GitHub Pro	Yes
Organization	GitHub Free for organizations	No
Organization	GitHub Team	Yes
Organization	GitHub Enterprise Cloud	Yes; eligible project sites can also use access control

Prices can change, so check GitHub's pricing page before changing a subscription.

Publish from a private repository¶

1. Check the owner and plan¶

Identify whether the repository belongs to a personal account or an organization. Use Pro or higher for a personal repository and Team or higher for an organization repository. If a plan downgrade removes private-repository Pages support, the site may be unpublished rather than converted into a private site. ³

2. Configure the publishing source¶

Open Settings → Pages in the repository, then choose a source under Build and deployment. GitHub Pages supports: ²

the root (/) or /docs folder of a branch
a GitHub Actions workflow

A branch source works for prebuilt static files. Use GitHub Actions when a generator such as MkDocs must build the site. See Publish an MkDocs site with GitHub Pages for a complete setup.

3. Verify the URL and visibility¶

After deployment, open the URL shown under Settings → Pages in a signed-out or private browser window. If it loads, the site is operating as a normal public Pages site even though its repository is private.

Private publication is available only for an eligible project site built from a private or internal repository owned by an Enterprise Cloud organization. Access control is not available for an organization site. ⁴

Security considerations¶

Keep secrets out of build output¶

Although the private repository itself is not exposed, visitors can download generated HTML, JavaScript, source maps, and other deployed assets. Never place the following in the build output:

API keys, access tokens, or passwords
internal URLs or customer information
configuration values or source maps that are not intended for publication

GitHub explicitly warns that Pages sites are available on the internet and that sensitive data should be removed before publishing. ²

Do not rely on a JavaScript password prompt¶

A password check implemented only in browser-side JavaScript exposes both the check and the protected assets to visitors. It is not meaningful access control. Use GitHub Pages access control or hosting with a real authentication gateway when the site must be private.

Configure a custom domain¶

Enter the domain under Settings → Pages → Custom domain, add the required DNS records, and then enable Enforce HTTPS. GitHub also recommends verifying the domain to reduce takeover risk. ³⁵

For a practical DNS and hosting comparison, see Free hosting with GitHub Pages and Cloudflare.

Troubleshooting¶

The site returns 404 after the repository became private¶

Check whether the current personal or organization plan supports Pages from private repositories. GitHub Free cannot keep a private repository as the publishing source.

Actions succeeds, but the site does not update¶

Confirm that Settings → Pages uses GitHub Actions as its source and that the workflow deploys to Pages. If you manage several sites, see How to manage multiple GitHub Pages sites.

Anyone can view the site even though the repository is private¶

That is the expected behavior for a standard Pages site. Repository visibility protects access to the source; it does not add authentication to the published website.

Summary¶

Use GitHub Pro for a private personal repository or GitHub Team or higher for a private organization repository. In both cases, the resulting Pages site is public by default. Restricting the audience requires an Enterprise Cloud organization and Pages access control.

Decide first whether you need to protect the source, the published site, or both. For automated publishing, continue with the GitHub Pages and MkDocs automation guide.