Skip to content

Getting started

This page explains how to protect the content of a content type, step by step. The same steps apply to any fieldable entity type, see Password protected view mode for other entity types than nodes.

How it works

When an entity is displayed in a protected view mode and the user does not have access, the module displays the entity with the Password protected view mode instead.

So the protection relies on two displays:

  • the protected displays (for example "Full content"), showing the content,
  • the "Password protected" display, showing the password form and only the fields that can be seen without password.

Each display only shows what you configure in it. The module does not hide any field by itself: you have to configure the "Password protected" display so that it does not show the protected fields.

1. Enable the modules

  • Enable the Entity Access Password module.
  • Enable at least one access storage backend module, otherwise the access granted by entering a password is not remembered:
    • Entity Access Password Session Backend: stores granted access in the session, works for anonymous users.
    • Entity Access Password User Data Backend: stores granted access in the user data, for a persistent access, does nothing for anonymous users. See User data backend.

2. Configure the global password (optional)

If you want to use a global password, shared by all the protected entities using it, set it on the configuration page: /admin/config/content/entity_access_password/settings.

3. Add a password field

On the content type, in Manage fields, add a field of type Password protection.

In the field settings:

  • Choose the password levels, which can be cumulative:
    • Enable per entity password access check: each content has its own password, set by the editor.
    • Enable bundle password access check: one password for all the contents of this content type, set in the Bundle password setting. Entering it unlocks all the contents of this content type.
    • Enable global password access check: the global password configured in step 2. Entering it unlocks all the contents using the global password.
  • Check the View modes on which the access control is enforced. Nothing is protected if left empty.
    • The protection applies to the view mode requested to display the content, not to the display used to render it. So check every view mode in which your contents are displayed and must be protected, even if its display is not customized.
    • For nodes, the page of a content is displayed with the Full content view mode: check it to protect the content page, even if you have not customized its display (in this case Drupal uses the "Default" display to render it).
    • Also check the other view modes in which your contents are displayed, for example Teaser in listings, and Search index if you use the core Search module.
    • Checking Default does not protect the view modes rendered with the "Default" display. It only protects the contents explicitly displayed with the "Default" view mode, for example by a view configured to render them with "Default".
    • If the view mode used to display your entities is not in the list, create it, see Protect a view mode which is not listed.

4. Configure the form display

In Manage form display, make sure the password field is enabled, so editors can protect contents and set passwords.

The widget settings allow to:

  • Show widget details as opened by default.
  • Show entity title: whether the title is shown on protected contents, never / optional (choice of the editor) / always. See Show title feature.
  • Show hint: whether editors can enter a password hint, displayed with the password form.
  • Allow to generate a random password.

5. Configure the displays

This is the most important step: if the "Password protected" display is not configured, the protected content is displayed with the password form.

Enable the "Password protected" display

In Manage display, open Custom display settings at the bottom of the "Default" display, check Password protected and save.

Without this, Drupal uses the "Default" display instead of the "Password protected" one, so all the fields of the "Default" display are shown along with the password form.

Configure the "Password protected" display

In the Password protected display:

  • Show the password field with the Password form formatter. Its Help text setting allows to add a text with the form.
  • Only keep the fields which can be seen without password, for example an image or a summary. Disable all the fields you want to protect.

Configure the other displays

In the other displays (Default, Full content, Teaser...), disable the password field, or use its Boolean formatter to display if the content is protected (for example to show a lock icon).

The Password form formatter displays the password form as soon as the content is protected, even to users who already entered the password. So it should only be used in the "Password protected" display.

6. Protect a content

Edit a content, check Enable password protection in the password field and, depending on the levels enabled on the field, set a password (or generate one) and a hint.

7. Check the protection

Users with the Bypass password protection permission always have access to the protected contents, without password. As administrators have all the permissions, check the protection with another user or as an anonymous user, for example in a private browsing window.

If the protection does not work as expected, see the Frequently asked questions.