Skip to content

Sites Shield

Sites Shield puts a site behind an HTTP Basic-Auth user name and password while the other sites stay open, like Velmora on www.velmora.example before its launch. A protected site answers every request on its hostname with the prompt until the visitor enters the site's credentials, and its pages stay out of Drupal's page cache. The prompt's realm is "Restricted area", so it does not name the site. Scripts can send the credentials in a sites-shield header instead of Authorization, with the same Basic <base64 of user:password> value.

The protection covers the site's hostname only. Content the site shares with an open site shows there, and logged-in users who may view it read it on the hub.

Install

A project of its own, drupal.org/project/sites_shield:

composer require drupal/sites_shield
drush en sites_shield

Requires Sites.

Configure

Only platform administrators set password protection: the site's Password protection section, in the System group of its dashboard, takes Administer sites.

  1. Open the site's Password protection section.
  2. Tick Enable password protection.
  3. Enter User and Password.
  4. Click Save configuration.

The password is stored as a hash. On a later edit, an empty Password keeps the stored one. Unticking Enable password protection removes the protection and the credentials.

To protect a site on staging only, or with other credentials per environment, tick Value per environment for User name and password on the site type and set the credentials on the section's Environments tab (Environments).

Who passes without the prompt

  • Logged-in users with Bypass password protection. On the protected host the login page is protected too, so they enter the credentials once to log in.
  • Users who preview the site from the hub (Preview).

Settings

The setting plugins it adds, with their keys on Site settings:

Permissions

Permission Machine name
Bypass password protection skip sites_shield auth

Admin pages

Path Title
/admin/sites/{site}/shield Password protection

Last updated 2026-10-16

Used in