# Vercel deployment protection is free: lock previews and production without the add-on

> Vercel Authentication can now protect all deployments including production for free. Changelog Sep 9 — verify UI; docs may lag.
> By Dave · 2026-09-14
> Source: https://otf-kit.dev/blog/vercel-deployment-protection-free

On September 9, 2026, Vercel published [Protect production deployments for free on every plan](https://vercel.com/changelog/protect-production-deployments-for-free-on-every-plan). The claim is direct: **Vercel Authentication can protect all deployments in a project, including production, at no additional cost on every plan.** Previously, protecting production domains required the $150-per-month Advanced Deployment Protection add-on.

If you ship SaaS or internal tools on Vercel, that changes the cost math before launch. You no longer need to treat production URL gating as a paid add-on decision for Vercel Authentication. Still open your project settings and confirm what the UI offers today — some overview docs still describe older plan gates, while the [usage and pricing table](https://vercel.com/docs/deployment-protection/usage-and-pricing) lists All Deployments and Deployment Protection Exceptions as included on Hobby, Pro, and Enterprise.

This post covers that Sep 9 change and Security → Deployment Protection only. It is not about Sandbox, Queues, or the Agents hosting seam in [OpenAI Agents on Vercel](/blog/vercel-openai-agents-sandbox).

## What the changelog actually announced

![Vercel changelog page capture, https://vercel.com/changelog/protect-production-deployments-for-free-on-every-plan, 2026-09-14](https://cdn.otf-kit.dev/thumbnails/vercel-deployment-protection-free-changelog-shot-20260914113303.png)

Per the Sep 9 changelog:

- Vercel Authentication can protect **all deployments**, **including production**, at no additional cost on every plan.
- Before this change, protecting production required the **$150/month Advanced Deployment Protection** add-on.
- Visitors must sign in with a Vercel account that has access to the project — useful for internal tools, private dashboards, and sites not ready to launch.
- Path: project → **Security** → **Deployment Protection** → choose **All Deployments**.
- You can set this as the **team default** so new projects inherit Vercel Authentication for all deployments.
- **Deployment Protection Exceptions** are now free on every plan (one preview domain public; rest protected).
- **Pro teams can enable Password Protection for individual projects** instead of purchasing it for the entire team.

That is the claim set this article relies on. No invented feature matrix from older docs.

## Docs may lag — verify in the UI before you buy

The overview at [Deployment Protection](https://vercel.com/docs/security/deployment-protection) still has older language in places: Hobby Standard Protection leaving production public, All Deployments as Pro/Enterprise, and Advanced Deployment Protection still describing Password / private production / exceptions at $150/month for Pro.

Treat that as docs lag, not a license to invent a reconciled matrix:

1. Prefer the **Sep 9 changelog** as the product announcement.
2. Cross-check **Usage & Pricing**, which currently lists **All Deployments** and **Exceptions** as **Included** on Hobby, Pro, and Enterprise, and Password Protection on Pro as **$20/month per protected project**.
3. Before buying any legacy Advanced add-on, open **Security → Deployment Protection** and confirm selectable scopes on your plan.
4. If overview docs and the UI disagree, trust the UI for the project you are shipping.

Do not treat Hobby production protection as a settled absolute from older overview copy alone. The changelog announces All Deployments + Vercel Auth free on every plan; verify in settings because some docs may lag.

![Dex Luna Byte and Nova at a Deployment Protection hologram choosing All Deployments](https://cdn.otf-kit.dev/thumbnails/vercel-deployment-protection-free-hero-20260914d.jpg)

## Why this matters for production builders

Before Sep 9, the expensive fork was often: leave production open during private beta, or pay $150/month to gate production with Vercel Authentication. The changelog removes that fork for **Vercel Authentication + All Deployments**.

ICP consequence:

- Internal dashboards can ship behind Vercel Authentication without the old add-on budget.
- Pre-launch SaaS can gate production and preview URLs, then flip public at launch.
- One partner preview hostname can use a free **exception** without opening everything.

URL gating is not app auth, but it is part of the default posture before real users — adjacent to [Why sandbox MVPs break in production](/blog/mvp-breaks-at-production). Pair it with app-level auth. For scaffolding the product itself, see [How to build a SaaS app with AI](/blog/how-to-build-a-saas-app-with-ai); this post is the deployment-access side.

## How to enable All Deployments with Vercel Authentication

Steps mirror the changelog (labels can move):

1. Select the project in the Vercel dashboard.
2. Open **Security** → **Deployment Protection**.
3. Choose **All Deployments**.
4. Confirm method **Vercel Authentication**.
5. Save, then open production and preview URLs in a signed-out browser. Expect a sign-in challenge when protection is active.

Optional: set the same config as the **team default**. Override per project for public marketing sites.

```bash
# Illustrative signed-out check — replace with your Domains panel URLs
open "https://YOUR_PRODUCTION_DOMAIN"
open "https://YOUR_PREVIEW.vercel.app"
```

If production stays public while previews are gated, you are likely still on **Standard Protection**. Confirm the dropdown shows **All Deployments**.

![All Deployments locks prod and preview; Standard leaves production open](https://cdn.otf-kit.dev/blog/vercel-deployment-protection-free/inbody-all-deployments-20260914d.jpg)

## Exceptions and Password Protection

**Exceptions (free per changelog + pricing table):** make one specific preview domain public while the rest stays protected. Prefer a narrow exception over disabling protection project-wide. Prefer **Protection Bypass for Automation** for CI/E2E (included on the pricing table) when the consumer is tooling, not humans. An exception is reachable by anyone — use it only when public access is acceptable. Older docs may still call Exceptions Advanced/Enterprise; verify the UI.

**Password Protection on Pro:** changelog says per-project enablement instead of a team-wide purchase. Pricing table currently lists **$20/month per protected project** on Pro (not on Hobby; included team-wide on Enterprise). Use Vercel Authentication when collaborators already have Vercel accounts; use Password Protection when you need a shared password for people without accounts. Existing Advanced add-on customers may still see team-level invoice lines until they switch — read the invoice before assuming the new charge.

![Byte and Nova show one exception domain public while other deployments stay locked](https://cdn.otf-kit.dev/blog/vercel-deployment-protection-free/inbody-exception-20260914d.jpg)

## Decision guide and cost math

| Situation | Prefer |
| --- | --- |
| Internal tool forever private | All Deployments + Vercel Authentication |
| Pre-launch SaaS; prod reserved but not public | All Deployments + Vercel Authentication |
| Launched public product with app auth | Standard Protection or None on marketing |
| One partner preview hostname | All Deployments + one Exception |
| CI hitting protected URLs | Protection Bypass for Automation |

Leaving production open remains correct for many launched products. The change is that locking production with Vercel Authentication is no longer behind the $150 Advanced add-on.

Published figures only:

- Changelog prior cost: Advanced add-on **$150/month**.
- All Deployments + Vercel Auth: **$0** Deployment Protection add-on (changelog + pricing Included).
- Pro Password Protection: **$20/month per protected project** (pricing table).

```text
# Illustrative: $150/mo * 12 = $1800/yr prior add-on reference
# New All Deployments + Vercel Auth: $0 Deployment Protection add-on
```

That is the prior cost the changelog references — not a claim every team paid it.

URL protection does not replace app auth or Enterprise network controls (Trusted IPs / Passport on the pricing table). If anonymous public users need production, do not use All Deployments on that domain.

## Checklist for this week

1. Read the [Sep 9 changelog](https://vercel.com/changelog/protect-production-deployments-for-free-on-every-plan).
2. Skim [Usage & Pricing](https://vercel.com/docs/deployment-protection/usage-and-pricing).
3. Open each project → Security → Deployment Protection.
4. Internal / pre-launch: All Deployments + Vercel Authentication; set team default if that matches how you create projects.
5. Exceptions only for preview domains that must be public.
6. Pro Password Protection per project only when a shared password is right.
7. Re-test prod and preview signed out.
8. Do not buy Advanced Deployment Protection solely for Vercel Authentication on all deployments until the UI still requires it — the changelog says that path is free.

## Sources

- [Protect production deployments for free on every plan](https://vercel.com/changelog/protect-production-deployments-for-free-on-every-plan) — Vercel Changelog, September 9, 2026 (primary).
- [Usage & Pricing for Deployment Protection](https://vercel.com/docs/deployment-protection/usage-and-pricing) — Included / $20 Pro password table (verify; may update).
- [Deployment Protection on Vercel](https://vercel.com/docs/security/deployment-protection) — overview; some sections still describe older plan gates as of 2026-09-14 fetch — re-check before buying add-ons.