Edge Delivery Services sites are public by default, which is wrong for a staging site, a partner portal, or an intranet. This post walks through the access-control options Adobe documents: token-based site authentication, CDN-level Basic authentication (GA, but not for live production domains), and OIDC sign-in (currently Beta). It also covers the limits Adobe states, like authentication only (no authorization) and whole-site-only protection, plus the documented fix when the Universal Editor starts returning 401.