A team enables “Discourage search engines from indexing this site” while preparing a website. Can people still open a shared URL, and what should the team check before uploading confidential material?

Yes. The search engine visibility setting requests that search engines avoid indexing the site; WordPress documentation explicitly says it still allows normal visitors. Someone with the URL may therefore open a public page. Treat the checkbox as an indexing preference, rather than evidence that access requires authorization.

First decide the intended audience. For an individual post or page, WordPress offers public, password protected and private visibility options. These have different effects, so test the chosen option with an account that represents the intended reader and again while signed out. A password protected page shares access with anyone who knows its password; it is not the same as assigning access to named users.

For a whole development site, ask the administrator to configure an appropriate access restriction and demonstrate it from a separate signed-out session. Check direct page URLs and file URLs as separate cases. Do not upload confidential documents until the intended restriction has been verified for the material involved.

Before launch, record which access controls and indexing settings should change, who will change them, and how the result will be tested. Removing the checkbox does not establish when a search engine will discover or index a page.

When requesting help, share the expected audience and an ordinary test URL. Keep passwords, private files and invitation links out of public discussion.

Sources: WordPress — Settings Reading screen · WordPress — Set blog content visibility.