--- title: "Static Studio – Private static site previews" description: "Say hello to private static site previews on Static Studio - better security, safer collaboration and more on our Static WordPress platform." date: "2026-10-06T13:43:03+02:00" language: "en-US" canonical_url: "https://simplystatic.com/tutorials/static-studio-private-static-site-previews/" source_url: "https://simplystatic.com/tutorials/static-studio-private-static-site-previews/" content_type: "text/markdown" --- #  Static Studio – Private static site previews [static hosting](https://simplystatic.com/tutorials/tag/static-hosting/), [website security](https://simplystatic.com/tutorials/tag/website-security/) 06/10/2026 On Sunday, October 4, some Static Studio customers were greeted by a bright red warning when they tried to open a `onstatic.studio` URL: Chrome called it a “Dangerous website” and advised visitors to turn back.**That is the kind of message nobody wants to see, especially when they are opening their own website. ![ Static Studio – Private static site previews 3](https://simplystatic.com/wp-content/uploads/2026/10/dangerous-site-chrome-warning.png) We immediately investigated, removed the abusive site that triggered the warning, notified customers in the Studio dashboard, and requested a review from Google. The important part first: No customer site was compromised, changed, or taken offline. The Static Studio dashboard and customer account data were safe, and websites using a custom domain were unaffected. The warning came from Google Safe Browsing and affected our shared `onstatic.studio` domain after someone abused a trial site to publish deceptive content. Because static previews and private WordPress addresses both use that parent domain, the warning could also appear when a customer opened a completely legitimate site of their own. The problem was the shared domain’s reputation, not a compromise of the customer’s website. The warning was temporary and has since been removed. But simply taking down one site would only have solved the immediate problem. We wanted to close the route that made this kind of abuse possible in the first place. That is why Static Studio previews are now private. ## What is a static site preview? Every site in Static Studio gets a managed `onstatic.studio` address. It gives you somewhere to review your static export before connecting a custom domain. You can use it to check pages, links, forms, images, and layouts without changing the public website your visitors already use. Until now, anyone who had that URL could open it. The address was intended for previews, but technically it was still public (even though it was always set to no-index). That made sharing a work in progress convenient, but it also let someone use a free trial as anonymous public hosting under our shared domain. One abusive site was enough to damage the reputation of that shared domain and cause warnings on legitimate `onstatic.studio` URLs too. That was the real problem we needed to solve. ## Static previews are now private by default Managed Static Studio preview URLs can now only be opened through an authorized Static Studio session. You don’t need to create a new password or manage a separate login screen. When you select Open Static Site Preview in the dashboard, Studio verifies that you have access to the site and creates a private browser session for that exact preview. The site then opens normally in a new tab. That browser session stays active for up to eight hours, so you can keep reviewing pages and refreshing the site without returning to the dashboard each time. If somebody opens the raw `onstatic.studio` URL without an active session, they will not see the website. Instead, they will see a private-preview page that asks them to return to the dashboard: ![ Static Studio – Private static site previews 4](https://simplystatic.com/wp-content/uploads/2026/10/private-preview-1024x605.png) For agencies using Static Studio’s white-label features, that page also uses the appropriate portal name, logo, and brand color. ## How to open a preview The workflow is intentionally simple: - Sign in to Static Studio. - Find the site or environment you want to review. - Select Open Static Site Preview. - Studio creates the private session and opens the preview. That is it. Authorized team members and clients can use the same flow for sites they have access to. If you send someone only the raw `onstatic.studio` URL, it will no longer give them access. They need to open the preview from their authorized dashboard session. ## Your public website is not affected This change applies only to the managed preview addresses provided by Static Studio. Once you connect a custom domain, that domain remains publicly available as usual. Visitors do not need to sign in, and there is no additional loading screen or password prompt. Your static site stays fast, secure, and available around the clock. The new access check sits in front of the preview address, not your production domain. The private preview also remains separate from WordPress. WordPress continues to run as your protected, on-demand editing environment and only starts when an authorized person needs it. ## Performance reports and automated checks still work Making previews private sounds simple until you consider everything in Static Studio that also needs to inspect them. Site Health, SEO checks, performance reports, publish-readiness checks, and Critical CSS generation all need access to the generated site. We updated those services to use short-lived, site-specific access behind the scenes. Performance reports for protected previews now run through a private Lighthouse session rather than sending the preview to Google PageSpeed. You do not need to configure anything, and the reports in your dashboard continue to work as before. Public sites on custom domains continue to use the normal public workflow. ## Why we made this change The incident on Sunday made an old distinction impossible to ignore: A preview URL is not the same thing as a public website. Preview addresses help you and your clients review work before launch. They should not double as anonymous hosting, and their safety should not depend on nobody guessing or sharing the URL. Making previews private gives us a much clearer boundary: - Work-in-progress exports stay between authorized users. - A free trial cannot publish an anonymous public site on our shared domain. - The anonymous preview route that one bad actor used to put other customers’ managed URLs at risk is closed. - Customer production domains remain public and unchanged. We would have preferred to introduce the feature without a red warning screen prompting it, but the outcome is a stronger and more accurate model for Static Studio: WordPress is private, previews are private, and the final static website becomes public on the domain you choose. ## What you need to do You don’t need to enable or configure anything. The next time you want to review a managed preview, open it from your Static Studio dashboard using Open Static Site Preview. If you have bookmarked an `onstatic.studio` preview, keep the bookmark if it is useful, but open the site through the dashboard first whenever your private session has expired. If a client needs access, assign them to the site so they can use the same secure workflow. If the website is ready for the public, connect its custom domain. As always, thank you to everyone who reported Sunday’s warning and gave us the information we needed to respond quickly. If you have any questions or feedback about private previews, feel free to reach out. Have a great week, Patrick Table of Contents ### Security Workbook Sign up and get our actionable WordPress Security Workbook** as a download straight to your inbox. #### Thank you! You have successfully joined our subscriber list. Table of Contents ### About the Author ![](https://simplystatic.com/wp-content/uploads/2026/06/patrickposner-wceu-profile-photo-2048x1917-1.jpg) **Patrick Posner** Founder and lead developer of Simply Static and a Static WordPress nerd. You can find me at various conferences, on Twitter/X or in our support desk. - [WordPress](https://profiles.wordpress.org/patrickposner/) - [X](https://x.com/patrickposner_)