Can GitHub Pages be private?

Access-controlled GitHub Pages sites require GitHub Enterprise Cloud, and viewers must be organization members with GitHub accounts. On Free, Pro, and Team plans, every Pages site is public even if the repo is private.

What do teams use instead of GitHub Pages for internal HTML?

Three patterns: a report-sharing layer like Comma when the HTML is a document people review (one POST, access control, comments, revisions); an identity proxy like Cloudflare Access in front of static hosting when it's a whole site; or GitHub Enterprise Cloud when every viewer already lives in the GitHub org.

How do I publish HTML from GitHub Actions without Pages?

POST the file to a sharing service from the workflow. With Comma it's one curl with a scoped token — each push appends a revision to the same URL, so the report link in your README never goes stale.

GitHub Pages alternatives for internal HTML

GitHub Pages has earned its place: push to a branch, get a URL, pay nothing. The catch is one word in the contract — public. The moment the HTML is a coverage report, a benchmark dashboard, or anything else you wouldn't put on the open internet, Pages stops being the easy option.

The actual constraint

Private Pages requires Enterprise Cloud. Access-controlled Pages sites are an Enterprise feature; below that, the site is public even when the repo is private.
Viewers must be GitHub org members. Your PM, your finance partner, your exec sponsor — everyone needs a GitHub seat and repo-level access to open a report. That's the wrong identity system for documents.
One site per repo, branch-based. Sharing many independent reports means repo gymnastics or a homegrown index.
No review layer. Nothing anchors feedback to the report; comments happen in Slack, detached from the thing being discussed.

The shortlist

1. Comma — when the HTML is a report people review

Publish from anywhere that can curl — including directly from GitHub Actions: one POST with a scoped token, and the report sits behind private, team, domain-gated, or link access. Repeat pushes append revisions to the same URL with diffs between any two. Teammates comment on the rendered document; agents can read and respond to those comments over MCP. Viewers don't need GitHub accounts — or paid seats of anything.

Not for: hosting a whole static site with deep internal routing. Comma's unit is the report.

Pricing: Free (3 active reports) · Pro $9/mo · Team $75/seat/mo · Enterprise custom.

Publish from CI →

2. GitHub Enterprise Cloud — if everyone is already in the org

Access-controlled Pages works, and it's zero new vendors. It's also a per-seat platform upgrade priced for the whole organization, purchased to gate static HTML. Right answer when you're on Enterprise anyway; expensive answer when you're not.

3. Cloudflare Pages + Access — self-assembled gating

Host on Cloudflare Pages (free), put Cloudflare Access in front, gate by email domain or SSO. Genuinely capable, free for small viewer counts — and you are now operating a zero-trust config for documents. See Cloudflare Access alternatives →.

4. Netlify / Vercel — app platforms with paid protection

Password or team-member protection exists on paid tiers, but you inherit the app-deployment mental model for what is, again, a document. See Vercel alternatives →.

At a glance

Tool	Private viewing	Viewer needs	Comments / history	Publish from CI
Comma	Private / team / domain / link	Email (or nothing, link)	Yes / yes	One curl
GitHub Pages	Enterprise Cloud only	GitHub seat + repo access	No	Native
CF Pages + Access	Yes (you configure it)	Email / SSO	No	Yes
Netlify / Vercel	Paid tiers	Password or team seat	No	Yes

Checked June 2026. Verify current gates and prices before committing.

How to choose

Public docs or project site? Keep GitHub Pages. It's free and good.
Internal report, dashboard, eval output? Use a sharing layer with access control and a review surface — that's the job Comma is built for.
Whole internal site behind your IdP? Cloudflare Access in front of static hosting is the engineering-grade answer, with the operational cost that implies.