Sites Shield adds an HTTP Basic-Auth login to individual sites managed by the Sites module, requiring visitors to authenticate with a per-site username and password before accessing any content. This is useful for hiding staging or pre-launch sites from search engines and public view.
Sites shield adds an HTTP Basic-Auth gate to individual sites managed by the
Sites module. Each site defines
its own username and password; visitors must authenticate before any page — including
403 and 404 responses — is served. It is the per-site equivalent of the
Shield module, ideal for hiding
staging or pre-launch sites from search engines and casual visitors.
Features
- Per-site username and password, configured right on the site edit form
- Protects every response, including error pages, by running before routing
- Passwords stored hashed via Drupal's password service
- Basic-auth requests excluded from the page cache, so protected pages never leak
- "Skip sites_shield auth" permission to let trusted roles through
- Accepts the standard Authorization header, PHP_AUTH_USER/PW, or a custom sites-shield header
Requirements
Drupal 11.2+ and the Sites module.
Getting started
Edit any site provided by Sites, open the Sites shield section, and set
a user and password. Leave the user empty to disable the shield for that site.
Depends on
Dependencies of the latest stable release
No dependencies recorded for this project.
Required by
Tracked projects that depend on this one
No tracked projects depend on this one yet.
More in the Sites ecosystem
Most installed first
Activity
Release Timeline
Releases
| Version | Type | Core | Release date | |
|---|---|---|---|---|
| 1.0.0-alpha2 | Pre-release | 11 | Aug 25, 2026 | |
| 1.0.0-alpha1 | Pre-release | 10–11 | Jun 23, 2026 | |
| 1.x-dev | Dev | 11 | Jun 23, 2026 |