Skip to content

Frequently asked questions

The password form is displayed with the protected content

The "Password protected" display is used, but it shows the protected fields:

  • If the Password protected display is not enabled in Manage display > Custom display settings, Drupal uses the "Default" display instead, with all its fields. Enable it.
  • If it is enabled, the "Password protected" display shows all the fields it is configured to show. Disable the fields you want to protect in this display.

See Getting started: configure the displays.

The content is displayed without the password form

  • You have the Bypass password protection permission, for example as an administrator: check with another user or as an anonymous user, in a private browsing window.
  • The content is not protected: check that Enable password protection is checked on the content.
  • The view mode used to display the content is not protected: check the View modes setting of the password field. For example, a node page is displayed with the Full content view mode, even if its display is not customized. See Checking the "Default" view mode does not protect the content and A view mode cannot be selected in the field settings.
  • You already entered a password unlocking this content, and the access is stored in your session or user data.

Checking the "Default" view mode does not protect the content

This is expected: the protection applies to the view mode requested to display the content, before Drupal chooses the display used to render it.

When a view mode has no customized display (its checkbox is not checked in Manage display > Custom display settings), Drupal renders it with the "Default" display. But the requested view mode is still the original one: for example Full content on the page of a node, or Teaser on the front page listing.

So checking Default only protects the contents explicitly displayed with the "Default" view mode, for example by a view configured to render them with "Default". Check every view mode in which your contents are displayed and must be protected, even if its display is not customized.

A view mode cannot be selected in the field settings

The View modes setting of the password field only lists the view modes existing for the entity type. Some entity types display their entities in a view mode which does not exist as a configuration. For example, a group page of the Group module is displayed with the full view mode, but Group does not provide it.

In this case, create the view mode in Structure > Display modes > View modes (/admin/structure/display-modes/view), with the machine name of the view mode used, for example full. It is then listed in the field settings and can be protected. You do not need to customize its display: it is still rendered with the "Default" display if its display is not customized.

The password form is still displayed after entering the password

  • No access storage backend module is enabled: enable the Session Backend and/or the User Data Backend sub-module. See Getting started: enable the modules.
  • You are anonymous and only the User Data Backend is enabled: it does nothing for anonymous users, enable the Session Backend.
  • The password field is displayed with the Password form formatter in the display used when you have access (for example "Default" or "Full content"): this formatter displays the form as soon as the content is protected, disable the field in this display.

The entity title is displayed on the protected content

See Show title feature, the title display is controlled per content and some places, like the breadcrumb, are not handled.

The access is lost when the password changes

This is expected, see User data backend for the user data backend option. Accesses stored in the session are always invalidated when the password changes.

The search index uses its own view mode: with the core Search module, protect the Search index view mode. With Search API, use the "Exclude password protected entities" processor on your index.

Protected contents are displayed from the cache to other users

The module does not change the HTTP response code, so reverse proxies may cache the pages. See Advanced usages.