Private pages
What private means on a StatusOwl status page: the page returns a 404. There is no password prompt and no SSO gate.
Every status page has a Public switch. This article explains exactly what turning it off does, because the word "private" means very different things across status page products and it would be easy to assume the wrong one.
What private does
Turning Public off stops the page being served. A visitor who opens the URL gets a 404.
That is the whole mechanism.
What private does not do
A private page does not prompt for a password. There is no shared secret, no access code, no signed link that lets a chosen person through, and no SSO or IdP gate. There is no allowlist of email addresses or IP ranges.
Nothing on a private page is visible to anybody through the public renderer, including you. To read it, use the dashboard.
Password-protected and SSO-gated pages are on the roadmap and have never shipped. If a competitor comparison or an older version of this documentation implied otherwise, it was wrong.
Public, Active and Default
Three switches, easy to confuse:
| Switch | Off means |
|---|---|
| Public | The page is private. Public requests get a 404. |
| Active | The page is disabled entirely. Public requests get a 404. |
| Default | Not the page served at the root of your subdomain. Other pages are unaffected. |
Public and Active have the same visible effect on a visitor — a 404 — but they are different intents. Use Active to retire a page, and Public to keep it running while it is not for public consumption.
Both switches save the moment you flip them.
What to use instead
Given how private works today, here is what actually solves the common cases:
"This page is for internal use." Keep it private and share what is on it through the dashboard, where roles and memberships are enforced properly. Do not treat an unlisted URL as a security control — treat the page as switched off, because that is what it is.
"This page is for one customer." There is no per-audience page gating. What you can do is give that customer their own page, on their own custom domain, showing only the services relevant to them. Pages are per-organization and cheap — Growth includes 10 and Scale is unlimited. That gives you separation by hostname and content, but not by authentication: anyone who has the URL can read it.
"I'm building the page and don't want it seen yet." Private is exactly right. Build it, attach services, set the branding, then flip Public on when you are ready.
What is still public when a page is private
Nothing. The public renderer refuses the page before it loads any of its content, so services, incidents, maintenance windows and uptime history are all unreachable. Incident and maintenance detail URLs under that hostname 404 too.
Custom domains do not change this. A private page on status.example.com is
still a 404 on status.example.com.
See also
- Create a status page — where the switches live.
- Custom domains — your own hostname; not an access control.
- Roles & permissions — real access control, in the dashboard.