spp

Introduction

Single Page Protection protects selected internal Drupal paths with per-page passwords. It supports Drupal 9.4+, Drupal 10, and Drupal 11 sites that need lightweight page-level protection without creating Drupal user accounts for every visitor.

Features

• Configure protected internal paths from the administration UI.
• Store page passwords as PHP password hashes.
• Edit protected paths and replace passwords without deleting records.
• Customize the password form instructions with a Drupal text format.
• Allow trusted roles to bypass page protection.
• Redirect anonymous visitors to the password form until the page password is valid.

Installation

composer require 'drupal/spp:^1.0'
drush en single_page_protection

Configuration

1. Grant administer single page protection only to trusted administrator roles.
2. Grant bypass single page protection only to roles that should skip protected-page passwords.
3. Go to Configuration > System > Single Page Protection.
4. Add internal paths such as /members-only and enter a password for each path.

Security and maintenance

Configured paths must be internal paths that start with /. Protocol-like values, control characters, duplicate paths, and the password form path itself are rejected. Passwords are stored as hashes, legacy plaintext records are rehashed through the update path, and access is controlled with restricted permissions. The project includes Drupal GitLab CI configuration and is maintained for Drupal 9.4, 10, and 11.

License

This project is licensed under GPL-2.0-or-later.