Skip to content

Password protection

Put a site behind a user name and password before it launches, while the other sites stay open.

Needs Sites Shield

Part of Sites Shield.

A protected site answers every request on its hostname with an HTTP Basic-Auth prompt until the visitor enters the site's credentials. Its pages stay out of Drupal's page cache. The prompt's realm is "Restricted area", so it does not name the site. Scripts can send the credentials in a sites-shield header instead of Authorization, with the same Basic <base64 of user:password> value.

The protection covers the site's hostname only. Content the site shares with an unprotected site shows there, and logged-in users who may view it read it on the hub.

composer require drupal/sites_shield
drush en sites_shield

Protect a site

Only platform administrators set password protection: it takes Administer sites.

  1. Open the site's Password protection section (/admin/sites/{site}/shield, System group of the site dashboard).
  2. Tick Enable password protection.
  3. Enter User and Password.
  4. Click Save configuration.

The password is stored as a hash. On a later edit, an empty Password keeps the stored one. Unticking Enable password protection removes the protection and the credentials.

Per-environment credentials

To protect a site on staging and leave it open in production, or to use other credentials per environment:

  1. On the site type, tick Environment overrides for User name and password.
  2. In the site's Password protection section, open the Environments tab.
  3. Click Override next to the environment and set its credentials.

How environments work: Setting layers.

Who passes without the prompt

  • Logged-in users with Bypass password protection. On the protected host the login page is protected too, so they enter the credentials once to log in.
  • Users who preview the site from the hub (Preview).