This project is not covered by Drupal’s security advisory policy.
Introduction
Single Page Protection protects selected internal Drupal paths with per-page passwords. It supports Drupal 10 and Drupal 11 sites that need lightweight page-level protection without creating Drupal user accounts for every visitor.
Features
- Configure protected internal paths from the administration UI.
- Store page passwords as PHP password hashes.
- Edit protected paths and replace passwords without deleting records.
- Customize the password form instructions with a Drupal text format.
- Allow trusted roles to bypass page protection.
- Redirect anonymous visitors to the password form until the page password is valid.
Installation
composer require 'drupal/spp:^1.0' drush en single_page_protection
Configuration
- Grant
administer single page protectiononly to trusted administrator roles. - Grant
bypass single page protectiononly to roles that should skip protected-page passwords. - Go to Configuration > System > Single Page Protection.
- Add internal paths such as
/members-onlyand enter a password for each path.
Security and maintenance
Configured paths must be internal paths that start with /. Protocol-like values, control characters, duplicate paths, and the password form path itself are rejected. Passwords are stored as hashes, legacy plaintext records are rehashed through the update path, and access is controlled with restricted permissions. The project includes Drupal GitLab CI configuration and is maintained for Drupal 10 and Drupal 11.
License
This project is licensed under GPL-2.0-or-later.
Project information
- Project categories: Access control
- Ecosystem: Page Access
58 sites report using this module- Created by mustafasayilan on , updated
This project is not covered by the security advisory policy.
Use at your own risk! It may have publicly disclosed vulnerabilities.
Releases
1.0.10
released 14 July 2026
Works with Drupal: ^10 || ^11
Drupal 10/11-only compatibility metadata and documentation update.
Install:
