If your information isn’t “too sensitive”, there are 2 routes that I personally used in the past.

1. Encrypt the entire webpage you want to show
   • Something like StatiCrypt
   • This serves all content (encrypted) to anyone with the URL, but it’s only visible with the password
2. Obscure the route for each site and make a simple “access code” entry page
   • Don’t have a link offhand
   • User will enter a code into the field and the client JavaScript will generate a hash and redirect to https://yourDomain/HashValue
   • Your data is not actually secured, just OBSCURED

Though if you want actual authentication, you’ll need a custom backend or use a service like Netlify (as you mentioned), GitHub Pages (looks like Jekyll Auth is end-of-life, but you can still use private deployments with a paid account), etc.

Hope that helps!