Project: beautiful-medovik-0d21e8 (Site ID 5fa77c6c-bfd5-482c-bf8b-900c1f885821), team panfxtradingjournal, Free plan.
Project configuration > General > Visitor access shows “Production visibility: Public” and “Deploy Preview visibility: Public” (confirmed via the dashboard UI and via direct DOM inspection of the visibility form’s radio inputs - “Customize this project’s visibility” and “Public” are genuinely checked, not just displayed).
Despite this, an anonymous, unauthenticated request to https://beautiful-medovik-0d21e8.netlify.app/ consistently returns HTTP 401. This has been reproduced dozens of times over more than an hour from a fetcher with no session/cookies for this account.
Troubleshooting already done, all without success:
1. Re-saved the visibility setting as Public (no change - still 401 anonymously).
2. Triggered a brand new production deploy via Netlify Drop (drag-and-drop a new zip) - new deploy published, still 401 anonymously immediately after and several minutes later.
3. Toggled visibility to Private, saved, then immediately back to Public, saved (to force a genuine state transition rather than re-saving an unchanged value) - still 401 anonymously afterward.
4. Checked Firewall Traffic Rules: Default traffic setting is “Allow all traffic” for both published and unpublished deploys, no geographic/IP restrictions set.
5. Checked Web Application Firewall: Baseline ruleset protection is Disabled.
6. Checked OAuth: no authentication providers installed.
7. Checked Team settings > Visitor access: “Default project visibility: Private for new projects” - but the page’s own text confirms this is only a default for new projects and does not override a project’s own customized visibility setting, which is already customized here.
8. Checked netlifystatus.com: All Systems Operational, no active incident.
Hard evidence this isn’t propagation delay: the project’s own Observability page (last hour) shows BOTH outcomes happening simultaneously on the live production URL right now - 200 responses (from requests carrying my own Netlify team session) and 401 responses (from anonymous requests), with the 401s returned in well under 1ms (p50 duration 0.44ms), consistent with an edge-level access-control rejection happening before any content is served - i.e. the edge is still enforcing this project as Private for unauthenticated visitors, regardless of what the dashboard displays as saved.
This looks like a genuine inconsistency between the control-plane visibility setting (correctly saved as Public) and the data-plane/edge enforcement (still treating the project as Private for anonymous requests). Could someone from the Netlify team take a look at this project’s edge access-control configuration? Happy to provide any additional diagnostics needed.