ChatGPT Sites includes managed publishing and, for eligible accounts, custom-domain support. It is still a beta service with plan-based limits and specific data-control rules, so attaching a business domain should come after you have reviewed access, privacy, and fallback requirements.
Custom domains
OpenAI says custom domains are available where the option is supported. Connecting one requires control of the domain’s DNS records so the domain can be verified and pointed to the hosted site.
The exact setup values should come from the Sites settings for your project. Do not copy DNS values from another project, and do not remove existing mail or verification records unless the setup instructions explicitly require it.
Before changing DNS:
- Finish and test the site on its default hosted URL.
- Record the current DNS entries or export the zone.
- Add only the records supplied for your project.
- Test both the root domain and any
wwwversion you intend to use. - Confirm HTTPS, redirects, and important pages after the change propagates.
OpenAI’s launch help article says custom domains are not available for Enterprise at launch. Other accounts may also lack the option because of rollout timing or workspace policy.
Every deployment is production
OpenAI does not document a separate staging deployment. Each deployment URL is production, which means visitors may see a newly published version immediately.
Save a known-good version before a large edit. Preview navigation, forms, calculations, mobile layouts, and legal pages before deploying. If the site performs an important business function, keep a rollback or alternative-hosting plan rather than relying on an untested beta workflow.
Usage limits
Sites has limits that vary by plan. OpenAI says exceeding them can prevent new site creation, restrict storage, or affect a public site with high usage. The help article does not present one universal traffic or storage allowance for every account.
Use the limits shown in your account as the current source of truth. A site that expects campaigns, viral traffic, large file uploads, or uninterrupted availability needs load testing and an operating plan beyond a successful preview.
Usage limits are not the same as browser performance. A page can be within its account allowance and still load slowly because of oversized images, unnecessary scripts, or inefficient client-side behavior.
Storage and visitor data
OpenAI’s developer guide describes D1 for durable structured data and R2 for file storage. The availability of storage does not make every use of personal information appropriate.
Collect only the data the site needs. Explain what is collected, why it is needed, where it is sent, and how a visitor can request deletion or correction when applicable. Test authentication and authorization from a signed-out browser; a hidden button is not an access-control system.
Sites does not support data or inference residency at launch, according to OpenAI. Organizations with location-specific data requirements should review that limitation before using the service.
ChatGPT data controls
OpenAI states that Business, Enterprise, and Edu data is not used to train models by default. For Free, Go, Plus, and Pro, conversations may be used to improve models if the account’s “Improve the model for everyone” setting is enabled.
That account setting is only part of the privacy picture. A published site may also use analytics, forms, embedded media, external APIs, or advertising services. Those services have their own data flows and must be reflected in the site’s privacy notice.
Secrets and API keys
Never put a password, private token, or API key in the prompt, repository files, client-side JavaScript, or public page. OpenAI documents a secrets area in Sites settings for supported server-side access.
Even a stored secret should have the smallest permissions possible. Rotate it if it is exposed, restrict the domains or operations it can use, and make sure an unauthenticated visitor cannot trigger expensive or private actions.
Sharing controls
Depending on account and workspace settings, a project may be shared with invited users, a workspace, or anyone with the link. Enterprise public publishing is disabled by default.
Test the final choice in a private browser window. If a site should be private, verify that an uninvited visitor receives an access check rather than simply hiding the content after it has loaded.
For plan and regional eligibility, see ChatGPT Sites availability. For the complete workflow, start with what ChatGPT Sites is.
Official sources
OpenAI’s ChatGPT Sites help article covers domains, plan limits, sharing, data controls, and residency. The Sites developer guide covers production deployments, project metadata, D1, R2, workspace identity, and secrets.
FAQ
Can I connect my own domain to ChatGPT Sites?
Yes, where custom domains are enabled for the account and workspace. Enterprise custom domains are unavailable at launch.
Does ChatGPT Sites have unlimited traffic?
No. OpenAI documents plan-based beta limits and possible restrictions for high-usage public sites.
Can I use a separate staging site?
OpenAI says every deployment URL is production. Preview and save a version before publishing.
Are ChatGPT Sites projects used for model training?
Business, Enterprise, and Edu data is not used for training by default. Individual-plan behavior depends on the account’s data-control setting.
Can I store API keys in a site?
Use the supported secrets settings, not a prompt, public file, or browser code. Limit and rotate every credential.
Does Sites support data residency?
OpenAI says data and inference residency are not supported at launch.