Searchable + private: when one document should be both (2026)

The account has twenty active links — eighteen are private (client previews, internal reports, AI artifacts under NDA), two should be public (a portfolio landing, a published case study you reference in pitches). The eighteen need to stay default-noindex. The two need to be findable in Google.

The choice isn't "switch the whole account to public hosting" — that exposes the eighteen wrongly. It's also not "host the two on a separate platform" — that fragments where your URLs live. The right shape is one account, default-private, with two specific documents marked indexable.

What "searchable" actually does

When you flip a document to searchable, three things happen:

1. The page's <meta name="robots"> changes from noindex to index, follow. Search engines arriving at the URL learn they're allowed to add it to their index.
2. The URL appears in the host's public sitemap.xml. Google discovers it during a normal crawl of your domain.
3. The page becomes discoverable via search. Over the next few days to weeks, the URL starts appearing in Google results for queries that match the page content.

None of these affect the other documents on the account. The default-noindex stays on everything else; the public listing only contains the URLs you specifically opted in.

For backstop — the unguessable slug stays in place even on a searchable doc. The URL is still hard to guess; you've just removed the meta-level "don't index" instruction. People who type random URLs still get nowhere.

Where the opt-in is the right call

Three patterns where the same account legitimately wants one public document:

• Portfolio landing on the same account as client work. The designer or studio uses the host for client deliverables (private). The portfolio page that lists those engagements (with public-okay framing) is the one that should be findable — see the personal portfolio post for the typical setup.
• Public case study alongside private working docs. The marketing-ready version of a project (published with the client's permission) is indexable; the working-version files (drafts, internal notes, the messy v1) stay default-private.
• Launch event microsite during the launch window. The launch page is meant to be found; the event microsite shape typically wants public discovery for the campaign window, then retires. Searchable opt-in handles the public part; the expiry handles the retirement.

In each case, the account doesn't fork into "public account" and "private account" — it stays one account with mostly-private use and a small public surface.

Where the opt-in is the wrong call

Equally important: cases where flipping searchable would be a mistake even if technically possible.

• NDA / confidential documents — anything covered by an agreement to keep the work private should not be findable, full stop. The unguessable URL is the access control; making it indexable removes that.
• Time-sensitive material that goes stale — a Q3 report that's correct in October would be misleading if it stayed indexed and got found by someone in February who didn't realize the date.
• One-recipient deliveries — a private link sent to one client doesn't benefit from being indexed; the audience is already defined.
• Anything the future-you might regret — pre-launch material, early versions of public work, drafts that might be wrong. Searchable is reversible (flip the toggle off), but Google's crawl-and-cache cycle means the URL might persist in indexes for weeks after the toggle flips.

Default-noindex isn't a limitation; for most files, it's the right shape. Searchable opt-in is the exception, not the new default.

The tier shape

Most private-link hosts that offer searchable opt-in cap the number per tier — not because the indexing is expensive, but because the cap is a soft brake on abuse cases (someone using "private" hosting as a public dump for SEO spam, content-farm operators, etc.).

The typical ladder:

• Free tier — 1 searchable. Enough to make a single portfolio page or case study findable; not enough to run as a publishing platform.
• Solo tier — 5 searchable. Room for the portfolio + case study + a launch microsite + a couple more, still bounded.
• Studio tier — unlimited searchable. For studios and agencies with a steadier stream of public-facing work alongside a private majority.

For most users with private-as-default work and one or two public-facing exceptions, the free tier's single searchable slot — or Solo's five when you want headroom — is enough; for studios and agencies with a stack of case studies plus a portfolio plus recurring launch pages, Studio's unlimited searchable covers the surface without a ceiling.

The walkthrough — flipping the toggle

1. Open the document in your account dashboard.
2. Find the "Visibility" or "Searchable" section — usually next to the password and expiry settings.
3. Flip the toggle from "Private (noindex)" to "Searchable (indexed)".
4. Confirm — the host warns about the change because it's a real visibility shift.
5. Wait for Google. Discovery typically takes 3-14 days; the first crawl after the URL appears in your sitemap.xml triggers indexing.
6. Verify via Google Search Console (if you've connected it) — the URL shows up under "Indexed" once Google has processed it.

To reverse: same toggle, flip back. Google's cache may keep the URL findable for another few weeks after the flip; for time-sensitive cases, the smarter pre-emptive move is to not opt in in the first place.

What this is not

Searchable opt-in doesn't turn a private-link host into a publishing platform. Two cases where the right shape is a dedicated public host:

• High-frequency publishing — a blog with weekly posts wants a CMS or static site generator with a proper publishing workflow. The searchable-opt-in cap and the per-file upload pattern would be tedious at that cadence.
• High-volume public content — a content-marketing operation with hundreds of indexed pages needs a real CMS, not a private-link host with five exceptions.

The right framing: searchable opt-in handles the exceptional public document on an otherwise-private account. For accounts that are mostly public, the public-host shape (Webflow, a static site generator, a CMS) is what fits.

For most users, the split is clean: private by default for the eighteen, searchable opt-in for the one or two. The toggle exists to handle the cases the default doesn't, not to replace the default.

Worth knowing what the other eighteen are actually resting on. Their privacy comes from an unguessable URL plus a no-index rule — not from a password, and the two aren't interchangeable. How password protection on a link actually works covers where a real gate sits in the request and why some implementations hand over the file before asking.