By Scott Sumner | AI Findability | Published October 18, 2026
A website preview should give your team room to review unfinished work without turning it into a public promise. Check who can open the preview, not just whether it appears in Google.
Answer: A preview URL is not private just because it is unlisted or marked noindex. Noindex controls search inclusion, not access. Protect nonpublic staging content with authentication, check direct file URLs, and verify the live site’s indexing settings separately at launch.
AI-assisted builds make it easy to produce a working page quickly. That is useful. But a page being ready to review and being ready for the public are two different decisions. The word “preview” does not make the second decision for you.
Jump ahead
- Unlisted, excluded and private are different
- What the WordPress checkbox actually does
- Check the preview as an outsider
- Keep the launch settings separate
- The question to ask your provider
Unlisted, excluded and private are different
A link that does not appear in your navigation may still open for anyone who has it. A page excluded from Google can also remain publicly accessible. Neither condition tells you whether the server checks who is requesting the content.
Google’s guidance on controlling shared content makes the distinction explicit: a page using noindex can still be visited directly or through links. For confidential or private content, Google recommends password protection so only authorized users can access it.
For a business owner, these are three different requirements:
- Unlisted: the page is not promoted in the site’s normal navigation.
- Excluded from search: supported search engines are told not to include the page.
- Access restricted: the server requires authorization before delivering the protected content.
A review environment may need both access restrictions and appropriate search settings. The access restriction is what matters when the material must not be public. Search instructions are not a substitute.
This is not just about secret information. A draft can contain an unfinished price, an unapproved customer quote or a service description the team is still debating. Those examples are reasons to decide the audience deliberately, not claims that any particular client exposed them.
What the WordPress checkbox actually does
WordPress includes a setting labeled “Discourage search engines from indexing this site.” Its Reading settings documentation says normal visitors are still allowed and that the setting does not block access.
That checkbox can serve an indexing purpose. It does not turn a publicly reachable staging copy into a private workspace. The fact that you must log in to edit a page also does not mean visitors must log in to read it.
There is another technical detail worth passing to your web team. Google needs to crawl a page to see its noindex tag or response header. If robots.txt blocks that crawl, Google cannot read the instruction on the page. Google’s noindex documentation explains this interaction.
Do not respond by opening confidential content so a crawler can read a tag. Protect the content first. Have the team choose the correct search-removal process if a protected page was already indexed. Privacy and search cleanup are separate jobs.
Check the preview as an outsider
My first check would be a clean browser session with no existing login. Open the exact preview address the team uses for review. Does it request authentication before showing the page, or does it show the draft immediately?
A private browsing window helps avoid your ordinary login cookies, but it is not a complete security test. A company network, VPN or identity provider can affect the result. Ask the provider to verify access from outside the authorized environment as well.
Then check more than the homepage. A useful review covers one inner page, one direct image or PDF address, and any separate preview hostname. Protecting a page does not establish that every file linked from it has the same protection.
Use a harmless test file rather than uploading sensitive information to see whether the restriction works. The goal is to prove the boundary without creating a new exposure.
Ask the team to record which addresses are protected and how reviewers receive and lose access. If the preview platform relies on a special sharing link, understand whether possession of that link is enough to enter. Forwarding the link may also forward access.
You do not need a list of every server setting. You need an observable answer to “Can an unauthorized visitor read this?” A screenshot of the WordPress search checkbox does not answer that question.
Keep the launch settings separate
The preview and production site have different jobs. Reviewers need controlled access to unfinished work. Buyers need access to the approved public pages, and search engines need the intended crawl and indexing permissions.
Write those expectations down separately before the launch. Otherwise a team can solve the staging problem and carry its restrictions onto the public site, or open the production site while leaving an old preview copy publicly available.
For the approved public site, ask the team to check the actual robots tags and response headers, access settings, canonical URLs and sitemap. Removing a staging restriction does not guarantee indexing, but leaving an unintended noindex instruction can prevent the desired Google inclusion.
For the old preview, decide whether it should remain protected for future work or be retired. Do not leave its future to whoever last had the browser tab open.
This complements a redesign plan that preserves important URLs. Moving visitors to the right public page and keeping unfinished copies out of circulation are different parts of a controlled launch.
The question to ask your provider
Ask: “Can you show me what an unauthorized visitor sees at our preview URL and at a direct file URL?”
That demonstration is more useful than assurances that the address is obscure. It also gives reviewers confidence that they can work on a draft without treating every unfinished sentence as public copy.
I want businesses to use AI to build and improve websites faster. I also want the release decision to remain intentional. Fast production is a benefit when the business still controls who sees the result.
If that boundary is unclear, a Website Findability Audit is a practical place to review the public discovery and launch settings. For help with a specific preview or staging concern, send Scott the platform name and the intended access rules, not passwords or confidential files.
Sources
Official documentation checked October 18, 2026. This is evergreen web strategy guidance, not a newly announced Google or WordPress change. The review steps above are Scott’s recommendations based on the documented distinction between access and indexing.