# Codex keeps publishing to ChatGPT Sites. Here is how to stop it · Stacktree

Source: https://stacktr.ee/blog/stop-codex-publishing-to-chatgpt-sites

[Skip to content](#main) [Stacktree](/)[Developers](/developers)[Agents](/agents)[Docs](/docs)[Use cases](/use-cases)[Pricing](/pricing)[Blog](/blog)[Dashboard](https://app.stacktr.ee)[Sign in →](https://app.stacktr.ee)      By [ Steve Smith ](/about) · Founder, Stacktree  ·  Last updated September 11, 2026          blog · 11 September 2026

#  Codex keeps publishing to ChatGPT Sites. One line stops it.

   Under OpenAI's five-million-Sites announcement, three developers said a version of the same thing: Codex puts every viewable thing it makes onto a Site unless told not to. One of them fixed it with a sentence in AGENTS.md. This post gives you the sentence, explains what triggers the behavior, and shows how to hand Codex an explicit publish tool so that sharing is a decision rather than a side effect.

  [ Get started free ](https://app.stacktr.ee/?join=1&from=seo_blog_stop_codex_publishing_to_chatgpt_sites)   install npx stacktree-install
Copy
     No card · 3 pages free · about a minute

##  How do you stop Codex publishing to ChatGPT Sites?

Add a rule to AGENTS.md at the project root that says never to create or publish a ChatGPT Site unless asked by name, and to keep previews on localhost. Codex reads AGENTS.md every session. Then avoid the word "website" in prompts that mean "a local page", since the help center lists it as a Sites trigger, and give Codex a named publish tool for the times you do want a link.

## On this page

  -   01  [ What developers are reporting ](#reports)
-   02  [ Why it happens ](#why)
-   03  [ What a stray publish costs ](#cost)
-   04  [ The AGENTS.md block ](#agents-md)
-   05  [ Give Codex an explicit publish tool ](#tool)

## What developers are reporting

 Three replies to the 11 September announcement, from three different people:

  - "I had to add 'Never use ChatGPT Sites' to my AGENTS.md because Codex was putting every tiny local experience up on there."
 - "Codex promotes unnecessary publication instead of ci/cd until explicitly said not to, please fix it."
 - "Please let me disable the sites plugin inside of the desktop app. Having it spin up a site in Work is cool, but whenever I'm building a frontend on my computer, it always pulls in the sites skill and uses the design guidelines from the skill which I don't like."
  The third one is the most telling. It is not only that Codex deploys when it should not. When the Sites skill loads, it brings its own design guidelines with it, so a local frontend starts looking like a ChatGPT Site whether or not it ever becomes one. Another reply in the same thread noticed the result from the other side: "I saw another site in a totally different niche that looked oddly similar. Pretty sure it was ChatGPT-made too."

## Why it happens

 OpenAI's help center documents the trigger: "Include the word 'website' in your prompt, or mention @Sites." Sites is available in Work on the web and in Work or Codex in the desktop app, and in those surfaces it is a capability the model is encouraged to use. "Make me a page that shows the test results" contains a word that means "deploy this" to Codex and "open a file" to you.

 There is also a plain incentive gap. A deployed Site is a visible, demoable outcome, and an agent optimizing for a satisfying end state will prefer it to "the file is at ./out/index.html". That is the "promotes unnecessary publication" complaint in one sentence. It is not a bug in Codex so much as a default you have not overridden yet.

## What a stray publish costs

  - Quota. Sites usage is capped per account during the beta, on a meter that combines the number of Sites, storage and visits. Every accidental Site is a Site. [The 50% warnings people are posting](/blog/chatgpt-sites-usage-limits) often arrive with only one or two intentional Sites on the account.
 - Versions. Each save adds a version, users report versions cannot be pruned, and a Site Codex iterated on ten times has ten of them.
 - A URL with your handle in it. Every Site publishes at site-name.handle.chatgpt.site. A throwaway experiment gets an address with your name on it, and if you set it to "Anyone with the link" out of habit, an address anyone with the link can open.
 - An irreversible cleanup. Deleting a Site is permanent and export is not documented, so tidying up means confirming a slug you may not remember for a Site you did not mean to make.

## The AGENTS.md block

 Paste this into AGENTS.md at the root of the repo (create the file if it does not exist). Codex reads it at the start of every session, so it holds across prompts and across days.

```
`## Publishing

- Never create or publish a ChatGPT Site unless I ask for one by name.
- Local previews stay local: run a dev server and give me the localhost URL.
- When I ask you to share, send, or publish something, call the Stacktree
  MCP tool `publish_html` and return the private link it gives you.
- Revisions go to the same link: call `update_site` with the site id
  instead of publishing a new page.`
```

 The first line is the one that matters and it is deliberately absolute. "By name" means you can still say "make this a ChatGPT Site" when you want one; you just cannot get one by accident. The second line gives Codex the alternative it was missing: a preview it can point you at without deploying anything. The last two lines only apply if you install a publish tool, which is the next section, but they are harmless if you do not.

 Two habits reinforce the rule. Say "page", "file" or "local preview" rather than "website" when that is what you mean. And when you catch Codex proposing a Site mid-task, say no in the chat once; it will usually carry the correction through the rest of the session.

## Give Codex an explicit publish tool

 The reason Codex publishes on its own is that publishing is built in and sharing is not a separate verb. Making it a separate verb is the fix. Install [Stacktree as an MCP server for Codex](/codex):

```
`npx stacktree-install`
```

 Pick Codex when prompted. The installer signs you in through the browser and adds the server to Codex's MCP config, so the next session has two new tools: `publish_html` and `update_site`. Neither runs unless Codex calls it, and with the AGENTS.md block above it only calls them when you ask to share something. What you get back is a private link:

  - Unguessable by default. Nothing is public unless you make it public. The reader opens the link with no ChatGPT account and no sign-in.
 - Revisions on one URL. Codex calls update_site to replace the page in place. No versions to prune; the link you sent yesterday shows today's page.
 - Gates when you want them. A passcode, a company email-domain gate, an expiry or burn-after-read, each a tool argument rather than a build step.
 - No quota surprise. Caps are page counts and storage, printed on the pricing page and returned by get_me. Three pages free, no card, and the first publish works with no account at all.
  Keep ChatGPT Sites for the things it is good at: a full app with a database that a few named people should sign in to use. Give Codex a plain publish tool for everything that is a page, and the "putting every tiny local experience up on there" problem goes away, because there is no longer a reason for the agent to reach for a deployment when you asked for a look.

     See it in one call, no account

```
`curl -X POST https://api.stacktr.ee/sites -F file=@index.html
# → a private URL, live for 24h. Claim it free to keep it.`
```

If your agents emit HTML, they need a durable publish target: publish once, then
`update_site`
on every revision keeps the same URL forever. MCP, REST, and skills all speak it:
        the map is at [agent.txt](https://stacktr.ee/agent.txt).

[
Get an API key free
](https://app.stacktr.ee/?join=1&from=bridge_blog_stop_codex_publishing_to_chatgpt_sites)   Sharing as a verb Codex only uses when asked

 npx stacktree-install, pick Codex, and every publish is a tool call you can see: a private link, no sign-in to view, revisions on the same URL. Three pages free, no card.

  [ Install for Codex →
](https://app.stacktr.ee/?from=blog_cta_stop_codex_publishing_to_chatgpt_sites&join=1) Free to try: 3 pages, each live for 7 days. Own domain from $19/mo.
FAQ

## Frequent questions

     Why does Codex keep creating ChatGPT Sites? +  Because Sites is a first-class capability in ChatGPT Work and the desktop app, and the trigger is broad. OpenAI's help center says to "include the word 'website' in your prompt, or mention @Sites" to build one, and developers report Codex treating anything viewable as a candidate: "codex promotes unnecessary publication instead of ci/cd until explicitly said not to." Unless you say otherwise, a page you asked to see can become a deployed Site.   How do I stop Codex from publishing to ChatGPT Sites? +  Put an explicit instruction in AGENTS.md at the root of the project. One developer's version is literally "Never use ChatGPT Sites". The block on this page adds two more lines: keep previews on localhost, and use a named publish tool when sharing is actually wanted. Codex reads AGENTS.md on every session, so the rule holds without being repeated in each prompt.   Can you disable the Sites plugin in the ChatGPT desktop app? +  Not as a documented setting. A user asked for exactly this under the 11 September announcement, because building a frontend locally "always pulls in the sites skill and uses the design guidelines from the skill". Until there is a toggle, the AGENTS.md rule is the reliable control, plus avoiding the word "website" in prompts that mean "a local page".   Does a stray ChatGPT Site count against my usage limit? +  Yes. Sites usage is capped per account during the public beta, combining the number of Sites, their storage and their visits, and every saved version adds storage that users report cannot be pruned. A handful of accidental "tiny local experience" Sites is a real fraction of a Plus allowance. Delete the ones you do not need; deletion is permanent.   How do I delete a ChatGPT Site? +  Open Sites from the sidebar, open the Site, choose Delete site, type the Site slug in the dialog, and select Permanently delete. The help center warns that "you cannot restore deleted sites", and export is not documented, so copy out any source you want to keep before deleting.   What should Codex use to share a preview instead? +  A publish tool it only calls when told to. With Stacktree installed as an MCP server (npx stacktree-install, pick Codex), Codex gets publish_html and update_site. A call returns an unguessable private link, no sign-in to view, and revisions replace the page at the same URL. Nothing is published unless the tool is called, and the first three pages are free.
Keep reading

## Related guides

   -  [ Publish HTML from Codex The MCP install, the tool calls, and replace-in-place across sessions. ](/codex)
-  [ ChatGPT Sites usage limits What the 50% warning means, and what counts toward it. ](/blog/chatgpt-sites-usage-limits)
-  [ ChatGPT Sites explained The living status post on cost, access, domains and limits. ](/blog/what-is-chatgpt-sites)
-  [ ChatGPT Sites private sharing Who can open an invited Site, and why they still sign in. ](/blog/chatgpt-sites-private-sharing)
-  [ The publish_html MCP tool Arguments, gates, and what comes back. ](/mcp-publish-html)

References

## Sources and further reading

   -  [ OpenAI Help Center: Creating and managing ChatGPT Sites ↗ The trigger rule ("include the word 'website' in your prompt, or mention @Sites"), beta limits, and permanent deletion. ](https://help.openai.com/en/articles/20001339-creating-and-managing-chatgpt-sites)
-  [ ChatGPT Sites update: 5M sites (@ChatGPT) ↗ The 11 September 2026 announcement whose replies include the AGENTS.md workaround and the desktop-app plugin request. ](https://x.com/ChatGPT/status/2098457920291946894)
-  [ OpenAI Codex: AGENTS.md ↗ How Codex discovers and applies AGENTS.md instructions at the start of a session. ](https://developers.openai.com/codex/guides/agents-md)

##  Publish is a tool call, not a reflex

 Private link by default, no sign-in to view, revisions on the same URL. Codex only calls it when you ask.

 [
Sign up free →
](https://app.stacktr.ee/?join=1&from=cta_blog_stop_codex_publishing_to_chatgpt_sites)   install npx stacktree-install
Copy
       Private hosting for the HTML your agents make.

[](https://betalist.com/startups/stacktree?utm_campaign=badge-stacktree&utm_medium=badge&utm_source=badge-featured)[Featured on](https://devhunt.org/tool/stacktree)[](https://buildlist.io)[Get started free](https://app.stacktr.ee/?join=1)

## Product

- [Example deliverables](/examples)
- [Custom domains](/custom-domains)
- [Client feedback](/client-feedback-loop)
- [One-time links](/one-time-view-links)
- [See how pages get read](/page-engagement)
- [Made with Stacktree](/made-with)
- [Security](/security)
- [Watch the demo](/demo)

## Agents

- [All integrations](/agents)
- [Claude Code](/claude-code)
- [OpenAI Codex](/codex)
- [Cursor](/cursor)
- [Claude.ai connector](/claude-ai-connector)
- [MCP server](/mcp-publish-html)
- [Deploy from Claude Code](/deploy-html-from-claude-code)
- [Skills](/skills)
- [Slack app](/slack)
- [n8n node](/n8n)
- [Agent payments (x402)](/x402)

## Alternatives

- [All comparisons](/alternatives)
- [Head-to-head comparisons](/compare)
- [Tiiny Host](/tiiny-host-alternative)
- [GitHub Pages (private)](/github-pages-private-alternative)
- [Vercel](/vercel-alternative-for-agents)
- [ngrok](/ngrok-alternative-for-html)
- [Display.dev](/display-dev-alternative)
- [Static.app](/static-app-alternative)
- [OpenAI Codex Sites](/openai-codex-sites-alternative)
- [here.now](/here-now-alternative)
- [Shippage](/shippage-ai-alternative)
- [Best private hosting](/best-private-html-hosting)

## Use cases

- [All use cases](/use-cases)
- [Share with clients](/share-with-clients)
- [Send a file to a client](/share-html-file-with-client)
- [Share Claude artifacts](/share-claude-artifacts)
- [Share Jupyter notebooks](/share-jupyter-notebook-html)
- [Host Storybook privately](/host-storybook-privately)
- [Architecture diagrams](/share-architecture-diagrams)
- [AI-generated reports](/host-ai-reports)
- [Internal HTML tools](/internal-tool-hosting)
- [Private HTML hosting](/private-html-hosting)
- [Vibe-coded page hosting](/vibe-coding-hosting)
- [Leave a website builder](/website-builder-migration)

## Learn

- [Blog](/blog)
- [Glossary](/glossary)
- [FAQ](/faq)
- [Agent-loop hosting](/agent-loop-hosting)
- [Why agents need a publish primitive](/blog/why-agents-need-a-publish-primitive)
- [MCP servers explained](/blog/mcp-servers-explained-for-developers)
- [What changed in the 2026-07 MCP spec](/blog/mcp-2026-spec-changes)
- [Sites in Codex explained](/blog/sites-in-codex-explained)
- [Private-by-default hosting](/blog/private-by-default-html-hosting)
- [An agent paid us $1 (x402)](/blog/agent-paid-to-provision-itself)
- [When a loop hits a paywall](/blog/loop-engineering-paywall)
- [Pricing](/pricing)
- [Self-host (new)](/self-host)
- [Changelog](/changelog)
- [Docs](https://stacktr.ee/docs)
- [About](/about)
© 2026 Stacktree · stacktr.ee

[Privacy](/privacy)[Terms](/terms)[Security](/security)[Dashboard](https://app.stacktr.ee)[npm](https://www.npmjs.com/package/stacktree-mcp)[Sitemap](/sitemap.xml)[llms.txt](/llms.txt)[API spec](/openapi.json)

---
Full markdown summary of the Stacktree marketing surface: https://stacktr.ee/llms-full.txt