diff --git a/src/main/java/com/googlesource/gerrit/plugins/gitiles/GerritGitilesAccess.java b/src/main/java/com/googlesource/gerrit/plugins/gitiles/GerritGitilesAccess.java
index d89b748..86a9088 100644
--- a/src/main/java/com/googlesource/gerrit/plugins/gitiles/GerritGitilesAccess.java
+++ b/src/main/java/com/googlesource/gerrit/plugins/gitiles/GerritGitilesAccess.java
@@ -14,6 +14,8 @@
 
 package com.googlesource.gerrit.plugins.gitiles;
 
+import static com.google.gerrit.extensions.client.ProjectState.HIDDEN;
+
 import com.google.common.collect.Maps;
 import com.google.gerrit.common.Nullable;
 import com.google.gerrit.entities.Project;
@@ -123,7 +125,9 @@
     }
     Map<String, RepositoryDescription> result = Maps.newLinkedHashMap();
     for (Map.Entry<String, ProjectInfo> e : projects.entrySet()) {
-      result.put(e.getKey(), toDescription(e.getKey(), e.getValue()));
+      if (!e.getValue().state.equals(HIDDEN)) {
+        result.put(e.getKey(), toDescription(e.getKey(), e.getValue()));
+      }
     }
     return Collections.unmodifiableMap(result);
   }
diff --git a/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java b/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
index d8dee32..6a8c342 100644
--- a/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
+++ b/src/test/java/com/googlesource/gerrit/plugins/gitiles/ListProjectsAccessTest.java
@@ -16,6 +16,7 @@
 
 import static com.google.common.truth.Truth.assertThat;
 import static com.google.gerrit.acceptance.testsuite.project.TestProjectUpdate.allow;
+import static com.google.gerrit.extensions.client.ProjectState.HIDDEN;
 import static com.google.gerrit.server.group.SystemGroupBackend.ANONYMOUS_USERS;
 
 import com.google.common.collect.ImmutableSet;
@@ -26,6 +27,7 @@
 import com.google.gerrit.entities.Permission;
 import com.google.gerrit.entities.Project;
 import com.google.gerrit.extensions.api.projects.BranchInput;
+import com.google.gerrit.extensions.api.projects.ConfigInput;
 import com.google.gerrit.testing.ConfigSuite;
 import com.google.gerrit.util.http.testutil.FakeHttpServletRequest;
 import java.util.stream.Collectors;
@@ -92,6 +94,16 @@
         .containsExactly(ImmutableSet.of("refs/heads/visible"));
   }
 
+  @Test
+  public void listRepositories_hiddenShouldNotBeVisible() throws Exception {
+    assertThat(access().listRepositories(null, ImmutableSet.of()).keySet()).contains(project.get());
+    ConfigInput ci = new ConfigInput();
+    ci.state = HIDDEN;
+    gApi.projects().name(project.get()).config(ci);
+    assertThat(access().listRepositories(null, ImmutableSet.of()).keySet())
+        .doesNotContain(project.get());
+  }
+
   private GerritGitilesAccess access() {
     return plugin
         .getSysInjector()