Single Page Protection
Single Page Protection allows you to protect specific internal website pages with individual passwords, eliminating the need to create user accounts for each visitor. You can configure protected paths and their passwords through the administration interface, and customize instructions while allowing trusted roles to bypass the password prompt.
Introduction
Single Page Protection protects selected internal Drupal paths with per-page passwords. It supports Drupal 10 and Drupal 11 sites that need lightweight page-level protection without creating Drupal user accounts for every visitor.
Features
- Configure protected internal paths from the administration UI.
- Store page passwords as PHP password hashes.
- Edit protected paths and replace passwords without deleting records.
- Customize the password form instructions with a Drupal text format.
- Allow trusted roles to bypass page protection.
- Redirect anonymous visitors to the password form until the page password is valid.
Installation
composer require 'drupal/spp:^1.0' drush en single_page_protection
Configuration
- Grant
administer single page protectiononly to trusted administrator roles. - Grant
bypass single page protectiononly to roles that should skip protected-page passwords. - Go to Configuration > System > Single Page Protection.
- Add internal paths such as
/members-onlyand enter a password for each path.
Security and maintenance
Configured paths must be internal paths that start with /. Protocol-like values, control characters, duplicate paths, and the password form path itself are rejected. Passwords are stored as hashes, legacy plaintext records are rehashed through the update path, and access is controlled with restricted permissions. The project includes Drupal GitLab CI configuration and is maintained for Drupal 10 and Drupal 11.
License
This project is licensed under GPL-2.0-or-later.