Single Page Protection

Single Page Protection adds a separate password to selected internal Drupal paths. It is intended for lightweight page-level protection without creating an account for every visitor.

Features

• Manage protected paths and individual passwords from the administration screen.
• Store password hashes using Drupal's password API.
• Customize the instructions above the password form.
• Limit failed attempts by path and client address.
• Revoke existing page unlocks when the password changes.
• Allow explicitly trusted roles to bypass page protection.
• Check protection before Drupal's internal page cache serves a response and send Cache-Control: private, no-store for protected pages and password forms.

Installation and configuration

Install with composer require 'drupal/spp:^1.0', then enable single_page_protection.

Open Configuration > System > Single Page Protection and add an internal path such as /members-only with its password. Existing paths and passwords can be edited without removing the entry.

Grant administer single page protection only to trusted administrators. Grant bypass single page protection only to roles that should not be asked for a page password.

Protection boundaries

Protection applies to the exact configured URL path. It does not replace entity access control or automatically protect aliases, alternate routes, feeds, APIs, or downloadable files exposing the same content. Use Drupal's access permissions when content must be restricted everywhere.

When adding protection to a page previously served through a reverse proxy or CDN, purge its existing cache. External caches must respect the response's private, no-store headers.

Requirements

Requires Drupal ^10.6 || ^11.3. Use a security-supported core release. The current release has been tested on Drupal 10.6, 11.3, and 11.4.