OnMessage websites are 100% public spaces. Even after logging into an account that has proper password controlled access, content will not be visible on the front-end site if it is not set to a public security setting.