I want to test my website in a live environment before making it publicly available. The site is hosted on Vercel, but I do not want random visitors to discover or use it while it is still being tested. What is the safest setup for this?
4 Answers
If you do not need a public domain, use the generated preview URL and enable password protection. You can also restrict access through a basic-auth proxy or an IP allowlist. Testing locally first and deploying to staging afterward is safer than experimenting directly on production, even if the site is unlikely to attract visitors immediately.
Deployment protection is useful, but remember that automated services may also get blocked. OAuth callbacks, payment webhooks, cron jobs, and uptime monitors can receive a login page or a 401 response instead of reaching your app. Configure an approved bypass token or equivalent access method for those services before testing.
Protecting the URL is only part of the solution. Use a separate database, API keys, storage, and email catcher for staging so test signups, orders, and emails cannot affect real users. Preview deployments generally are not indexed by search engines, but authentication is still needed to stop someone who discovers or guesses the deployment URL.
The usual approach is to create a staging or preview deployment that mirrors production, then protect it with Vercel Authentication or password protection. Only you and your team can access it, while the public production deployment stays separate. A normal workflow is development locally, then staging, and finally production.
A separate staging branch or project makes this easier: deploy development changes there, verify everything, and promote only the tested version to production.