Administrator Login

Administrator Login restricts login and password reset to the accounts you choose, such as administrators. Use it for sites where only staff log in: brochure sites, intranets behind a public front end, or sites maintained by a small team.

Visitors keep seeing the site as usual; only logging in is restricted.

Features

• Choose who may log in with a permission, Log in when login is restricted. Roles marked as administrator always may.
• Every way in is covered:
  • the login form;
  • the password reset form;
  • one-time login links;
  • the JSON login;
  • modules that log users in, such as social login.
• Existing sessions: users already logged in who may not log in are logged out on their next page view. Optional.
• IP allowlist: optionally, allow login only from given addresses or ranges, such as your office network.
• No hints for attackers: a denied account gets exactly the same answer as a wrong password, and the password reset form shows its usual message without sending an email. Nobody can find out which accounts exist, which are administrators, or whether a password is right.
• Flood control: denied logins count as failed logins, so password guessing is blocked as usual.
• Logging: every denied login is written to the site log, with the account, the IP address and the reason.
• Lockout protection: the settings form will not save a change that would log you out, and the status report warns when nobody can log in.

Requirements

• Drupal 10.3 or later, or Drupal 11.

Installation

Install as you would normally install a contributed Drupal module. For further information, see Installing Drupal Modules.

composer require drupal/administrator_login
drush pm:enable administrator_login

The restriction is on as soon as the module is installed. The role named administrator gets the permission automatically; give it to any other role that needs to log in.

Configuration

1. Give the Log in when login is restricted permission to the roles that may log in, at People » Permissions.
2. At Configuration » People » Administrator Login (/admin/config/people/administrator-login), turn the restriction on or off, set allowed IP addresses, a message for denied logins, and whether to log out users and log denied logins.

Locked out?

drush config:set administrator_login.settings enabled 0 -y

Upgrading from 1.0

Run drush updatedb.

• The administrator role keeps being able to log in.
• User 1 and roles marked as administrator may now log in too; 1.0 could lock out user 1.
• Administrators can reset their password with their email address as well.
• The login form no longer reveals whether a password is right, and the password reset form no longer reveals who the administrators are.

Support

Report bugs and request features in the issue queue.