Login Disable

Block login to your Drupal site site-wide with controlled bypass.
Useful during maintenance windows, private staging, member freezes,
or pre-launch lockdowns. Two bypass mechanisms keep administrators
in: a per-role permission and an optional URL access key.

Features

• Master switch – One checkbox blocks all
  logins for non-bypass users.
• URL access key – Optional query parameter
  appended to /user/login?your-key bypasses the lock,
  without giving anyone permanent access.
• End-user message – Configurable warning
  shown to blocked users.
• Force logout – Optional kick-everyone
  switch that clears all existing sessions when the settings are
  saved (super admin and current user are excluded).
• REST login coverage – The
  user.login.http endpoint returns HTTP 403
  Access key required. when the key is missing, so the
  lock applies to JSON:API clients and decoupled front-ends too.
• Per-role bypass – The
  Bypass disabled login permission lets specific roles
  log in even when the module is active.
• Brute force protection – Multiple attempts are blocked by Drupal core flood.

Why use this module?

Drupal core has no built-in way to disable logins temporarily without
putting the whole site in maintenance mode. Login Disable does only
this one job, with predictable behaviour for both the UI login form
and the REST endpoint.