Private documentation

Private documentation

A project’s published site has one of three visibility modes.

The three modes

publicvisibility

Anyone may read it. Indexed by search engines. The default.

passwordvisibility

A reader must know a passphrase. One passphrase for the site, not an account each.

workspacevisibility

Only members of the workspace may read it, signed in. Use this for an engineering handbook or an internal runbook.

The passphrase

The passphrase is stored as a hash. There is nothing to read back, so the screen tells you whether one is set and offers to replace it. It never shows you the passphrase you chose.

Attempts are rate limited. A correct passphrase issues a session cookie, so a reader enters it once.

What private actually covers

This is the part to check when you rely on it:

Surface	Behaviour on a private site
Pages	Behind the gate.
Assets	Behind the same gate. Not on a permanently public URL.
Sitemap	Not served.
Search engines	noindex.
Site search	Authorised on the server, not filtered in the browser.
Ask	Answers only from pages the reader is allowed to read.
llms.txt	Not served.
Content API	Requires a token, as always.

Danger

Search on a private site is authorised server-side. Never assume a documentation tool does this; a search that fetches everything and hides the unauthorised results in the browser is a search that leaks them.

Drafts are separate

A draft: true page is not served on a public site or a private one. Visibility controls who may read the site. draft controls whether a page is part of it at all.

Previews

A preview of a branch is always noindex and always carries its own token, whatever the project’s visibility.

Availability

Private documentation is a Pro capability. See Plans.