Can you keep a .co.uk website private?

1. Decide what private means for your project

A site for invited relatives, draft client work or a members’ resource can all use a custom UK domain. Start with the audience rather than the address: who may read the material, who may upload it, and how will you remove someone’s access later? These answers determine which hosting features you need.

A public page with a link you do not advertise has a different access model from a site that checks each visitor’s permission. Likewise, a shared password differs from individual accounts. Choose deliberately before uploading anything you would not want available to an unexpected visitor. Ask the host to explain its actual privacy controls, including their limits.

2. Separate the address from the access controls

Registering the domain gives you the name for its paid term. DNS connects that name to a service. The website service must decide whether a visitor can retrieve each protected page or file. A DNS record does not provide a website login, approve a reader or hide a photograph.

Before buying hosting, confirm that its plan supports both your custom domain and the access restrictions you need. A feature called a private page may have a narrower scope than protecting an entire collection of uploads. Ask specifically about original files, previews and download links rather than relying on the feature’s name.

Swipe to compare the setup responsibilities on a small screen.

3. An unlisted address is not a locked page

A long or unadvertised URL can still be copied, forwarded or exposed in another context. If opening the address is enough to see the material, anyone who obtains it may be able to view it. Do not describe that arrangement to your readers as an account-protected service.

The robots.txt standard explicitly distinguishes crawler instructions from access authorisation. It also explains that listing a path there exposes that path publicly. A noindex instruction concerns search-engine indexing; it does not require a visitor to sign in. For private material, arrange enforceable access restrictions with the website service instead of relying on either setting alone.

HTTPS is another separate protection. It secures the browser connection, but a public page can use HTTPS just as a restricted page can. The presence of a secure connection therefore does not tell you which people are allowed to read the content.

Sources: RFC 9309: robots.txt and its security limits ↗ · RFC 9110: HTTP semantics, HTTPS and authentication ↗

4. Plan a private gallery before connecting the domain

Imagine a photographer preparing a draft gallery for two invited reviewers. This is a hypothetical planning example, not a NameUK customer story. The photographer chooses a service that accepts a custom domain, gives each reviewer an individual invitation and can withdraw their access when the review ends.

Before uploading the full collection, they use a harmless sample to check the experience. A signed-out browser must not retrieve protected content. An invited reviewer should see only the intended gallery, and access should stop through the supported process when that invitation is revoked. The original image and its download URL need checking as well as the page around them.

A login-looking screen alone is not sufficient evidence. Ask the hosting provider how protection applies to media storage and shared links. Keep a separate copy of important files and agree who will administer invitations, backups and support if the original organiser is unavailable.

5. Protect the accounts and test the intended boundary

Use a strong, separate password and suitable additional sign-in protection on the hosting account. The NCSC recommends securing important online accounts this way. Protect your domain account too, since changes there can affect where the address leads. Visitor permissions and administrator security are related responsibilities, but neither automatically configures the other.

For your own site, keep a short acceptance checklist before inviting readers. Use sample content and authorised accounts; do not probe another organisation’s website. Repeat the checks after relevant hosting, permission or custom-domain changes, and ask the host to investigate unexpected access before publishing private material.

• Open the intended private page in a fresh signed-out browser.
• Check a direct original-image or download link supplied by your own service.
• Confirm an invited reader reaches only the intended content.
• Check the host’s supported access-removal process with a test invitation.
• Check HTTPS and the correct hostname without changing unrelated email records.

Sources: NCSC: secure your important online accounts ↗

6. Budget for the domain and private hosting separately

Register .co.uk for £9.99 for one year, with annual renewal currently £9.99. Or choose a new three-year .co.uk registration for £25.99. Check the selected name and term before payment. Future renewal prices can change.

A private website still needs its domain renewed. The registration amount does not pay for a membership platform, gallery storage, mailbox or visitor-login system. Compare the host’s ongoing price and limits alongside the domain’s annual renewal, including any charge for connecting your own address.

The current NameUK .co.uk registration and renewal amounts below cover the domain service. The three-year amount is an initial registration offer; it does not include three years of private website hosting. Review the applicable renewal price when extending the domain term.

7. One domain can support public and private areas

You may want a public introduction alongside an invitation-only area. A website path or subdomain can serve that purpose if the chosen platform supports it. Calling an address members or private does not establish a security boundary: permissions still need to be enforced wherever the content is served. You do not necessarily need another domain registration.

For standalone .co.uk registration, clear annual renewal pricing and supported dashboard DNS controls, we recommend considering NameUK. This is our own recommendation for those needs, not a hosting-security assessment or an independent market ranking. Choose and verify your website service separately, then follow its connection instructions when ready.

Before checkout, settle the audience, hosting requirements, intended holder and registration period. After registration, keep the confirmed expiry and service responsibilities together. A private project needs the same long-term control of its address as a public business website.