diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/AnonymousHttpScheme.java b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/AnonymousHttpScheme.java
index d816b2c..f18998a 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/AnonymousHttpScheme.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/AnonymousHttpScheme.java
@@ -30,6 +30,7 @@
   private final String gitHttpUrl;
   private final String canonicalWebUrl;
   private final boolean schemeAllowed;
+  private final boolean schemeHidden;
 
   @Inject
   public AnonymousHttpScheme(
@@ -39,6 +40,7 @@
     this.gitHttpUrl = ensureSlash(cfg.getString("gerrit", null, "gitHttpUrl"));
     this.canonicalWebUrl = provider != null ? provider.get() : null;
     this.schemeAllowed = downloadConfig.getDownloadSchemes().contains(ANON_HTTP);
+    this.schemeHidden = downloadConfig.getHiddenSchemes().contains(ANON_HTTP);
   }
 
   @Nullable
@@ -66,6 +68,11 @@
   }
 
   @Override
+  public boolean isHidden() {
+    return schemeHidden;
+  }
+
+  @Override
   public boolean isAuthRequired() {
     return false;
   }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/GitScheme.java b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/GitScheme.java
index d99d2ef..75691d6 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/GitScheme.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/GitScheme.java
@@ -26,11 +26,13 @@
 
   private final String gitDaemonUrl;
   private final boolean schemeAllowed;
+  private final boolean schemeHidden;
 
   @Inject
   public GitScheme(@GerritServerConfig Config cfg, DownloadConfig downloadConfig) {
     this.gitDaemonUrl = ensureSlash(cfg.getString("gerrit", null, "canonicalGitUrl"));
     this.schemeAllowed = downloadConfig.getDownloadSchemes().contains(ANON_GIT);
+    this.schemeHidden = downloadConfig.getHiddenSchemes().contains(ANON_GIT);
   }
 
   @Override
@@ -47,6 +49,11 @@
   }
 
   @Override
+  public boolean isHidden() {
+    return schemeHidden;
+  }
+
+  @Override
   public boolean isAuthRequired() {
     return false;
   }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/HttpScheme.java b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/HttpScheme.java
index 8a75f5f..923470d 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/HttpScheme.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/HttpScheme.java
@@ -35,6 +35,7 @@
   private final String canonicalWebUrl;
   private final Provider<CurrentUser> userProvider;
   private final boolean schemeAllowed;
+  private final boolean schemeHidden;
 
   @Inject
   public HttpScheme(
@@ -46,6 +47,7 @@
     this.canonicalWebUrl = urlProvider != null ? urlProvider.get() : null;
     this.userProvider = userProvider;
     this.schemeAllowed = downloadConfig.getDownloadSchemes().contains(HTTP);
+    this.schemeHidden = downloadConfig.getHiddenSchemes().contains(HTTP);
   }
 
   @Nullable
@@ -93,6 +95,11 @@
   }
 
   @Override
+  public boolean isHidden() {
+    return schemeHidden;
+  }
+
+  @Override
   public boolean isAuthRequired() {
     return true;
   }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/RepoScheme.java b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/RepoScheme.java
index 7b5ddef..7961378 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/RepoScheme.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/RepoScheme.java
@@ -22,10 +22,12 @@
 
 public class RepoScheme extends DownloadScheme {
   private final boolean schemeAllowed;
+  private final boolean schemeHidden;
 
   @Inject
   RepoScheme(DownloadConfig downloadConfig) {
     this.schemeAllowed = downloadConfig.getDownloadSchemes().contains(REPO);
+    this.schemeHidden = downloadConfig.getHiddenSchemes().contains(REPO);
   }
 
   @Override
@@ -39,6 +41,11 @@
   }
 
   @Override
+  public boolean isHidden() {
+    return schemeHidden;
+  }
+
+  @Override
   public boolean isAuthRequired() {
     return false;
   }
diff --git a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/SshScheme.java b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/SshScheme.java
index f825745..4628f73 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/download/scheme/SshScheme.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/download/scheme/SshScheme.java
@@ -39,6 +39,7 @@
   private final int sshdPort;
   private final Provider<CurrentUser> userProvider;
   private final boolean schemeAllowed;
+  private final boolean schemeHidden;
 
   @Inject
   @VisibleForTesting
@@ -82,6 +83,7 @@
 
     this.userProvider = userProvider;
     this.schemeAllowed = downloadConfig.getDownloadSchemes().contains(SSH);
+    this.schemeHidden = downloadConfig.getHiddenSchemes().contains(SSH);
   }
 
   @Nullable
@@ -115,6 +117,11 @@
   }
 
   @Override
+  public boolean isHidden() {
+    return schemeHidden;
+  }
+
+  @Override
   public boolean isAuthRequired() {
     return true;
   }
diff --git a/src/main/resources/Documentation/config.md b/src/main/resources/Documentation/config.md
index ecf4ff9..d86b5df 100644
--- a/src/main/resources/Documentation/config.md
+++ b/src/main/resources/Documentation/config.md
@@ -22,6 +22,7 @@
   scheme = anon_http
   scheme = anon_git
   scheme = repo
+  hide = ssh
 ```
 
 The download section configures the allowed download methods.
@@ -74,6 +75,16 @@
 	If `download.scheme` is not specified, SSH, HTTP and Anonymous HTTP
 	downloads are allowed.
 
+<a id="download.hide">download.hide</a>
+:   Schemes that can be used to download changes, but will not be advertised
+    in the UI. This can be any scheme that can be configured in <<download.scheme>>.
+
+    This is mostly useful in a deprecation scenario during a time where using
+    a scheme is discouraged, but has to be supported until all clients have
+    migrated to use a different scheme.
+
+    By default, no scheme will be hidden in the UI.
+
 <a id="download.checkForHiddenChangeRefs">download.checkForHiddenChangeRefs</a>
 :	Whether the download commands should be adapted when the change
 	refs are hidden.