This module allows you to restrict access to your Drupal site's login form by requiring a secret key. Even if users know the key, their roles will still be checked to ensure they have permission to bypass the login restriction. This is useful for content freezes during site migrations or upgrades.
Block login to your Drupal site site-wide with controlled bypass.
Useful during maintenance windows, private staging, member freezes,
or pre-launch lockdowns. Two bypass mechanisms keep administrators
in: a per-role permission and an optional URL access key.
Features
- Master switch – One checkbox blocks all
logins for non-bypass users. - URL access key – Optional query parameter
appended to/user/login?your-keybypasses the lock,
without giving anyone permanent access. - End-user message – Configurable warning
shown to blocked users. - Force logout – Optional kick-everyone
switch that clears all existing sessions when the settings are
saved (super admin and current user are excluded). - REST login coverage – The
user.login.httpendpoint returns HTTP 403
Access key required.when the key is missing, so the
lock applies to JSON:API clients and decoupled front-ends too. - Per-role bypass – The
Bypass disabled loginpermission lets specific roles
log in even when the module is active. - Brute force protection – Multiple attempts are blocked by Drupal core flood.
Why use this module?
Drupal core has no built-in way to disable logins temporarily without
putting the whole site in maintenance mode. Login Disable does only
this one job, with predictable behaviour for both the UI login form
and the REST endpoint.
Ask your assistant about Login Disable
Check compatibility with your Drupal and PHP version, maintenance and security coverage, from current release data. How it works
Depends on
Dependencies of the latest stable release
- user Drupal core
Required by
Tracked projects that depend on this one
No tracked projects depend on this one yet.