Normandy was actually rather poorly defended by comparison to the Netherlands and Belgium and Pas-de Calais. It was unsuited for a naval invasion by its relative steepness and lack of connection to the rivers Rhine and Meuse which lead to Germany. Besides the Allies had a considerable decoy effort including counter-espionage planting false information which persuaded Germany that a naval invasion would take place near Calais. This was known as Operation Fortitude.

What you need to remember is that Germany had been expecting an allied invasion of France for a considerable time. Defensive works along the entire Atlantic coast (the so-called Atlantikwall) began in spring 1942, though only expanding to the entire coast in 1943.

All of the beaches suitable for a major allied landing (close to british airfields, short supply lines to britian, not fronting on to open ocean, etc...) were indeed fortified by the germans. The Atlantic Wall stretched from the spanish-french border up through denmark and all the way to northern norway. The Norman beaches were not 100% finished but the fortifications there were pretty extensive in the most vulnerable parts. They were weakly manned for the most part and the allies convinced germany that the landing was coming in the more logical area of the Pas de Calais so the germans put their best formations covering that sector. This made the Norman the next best area for a beach assault.

The allies also landed a decent size force later in southern france as part of Op Dragoon and found unfortified/unmanned beaches but it was so far away from their line of supply and main axis that it was pointless for anything other than a diversion or mopping up in southern france.

There are very limited areas on the coastline that would be suitable for a landing.

First, they established the zone where they would have total air superiority by limiting the possible landing areas to areas within the operational radius of the Spitfire. This covered from Pas de Calais to the Cotentin peninsula.

Within that area, there were only two suitable landing sites and, as Spinoza42 noted, there was a large decoy effort to convince the Germans that the landings would occur at Pas de Calais, which included inventing an entire fictitious army.

Other areas within the operational radius of the Spitfire were topographically unsuitable to be considered for a landing.

-The Second World War by John Keegan

There were landings on five beaches on D-Day.

Of them, ONLY Omaha was heavily defended, but saving private Ryan gave us the impression that the entire landing was very bloody.

If you look at Utah Beach for instance, there were only ~200 casualties among the men who landed, as oppose to more than 10 times as many on Omaha. Sword and Juno beach each "only" took around 1/3 the casualty of Omaha.