<p>I just released a plugin to solve this problem. No apache/nginx needed, just a simple plugin to install directly in Craft.</p>

<p><a href="https://github.com/dgrigg/knockknock" rel="noreferrer">https://github.com/dgrigg/knockknock</a></p>

CC BY-SA 4.0
2018-10-08T05:58:48.707Z
Derrick are there any plans to add support for Craft 3? Would appreciate it.
patrick.altair
CC BY-SA 3.0
2017-09-22T20:54:09.077Z
2017-09-22T20:54:09.077Z
Derrick Grigg
<p>I hate messing with .htaccess files across multiple environments. I also find .htaccess a bit of black magic as I don't understand regex :)</p>

<p>So here's my approach.</p>

<p>In index.php - right after the opening PHP tag - drop this in:</p>

<pre><code>if($_SERVER['SERVER_ADDR'] == '127.0.0.1') {

  $username = 'username';
    $password = 'password';

  if (!(isset($_SERVER['PHP_AUTH_USER']) &amp;&amp; ($_SERVER['PHP_AUTH_USER']==$username &amp;&amp; $_SERVER['PHP_AUTH_PW']==$password)))  {
        header('WWW-Authenticate: Basic realm="This site is protected"');
        header('HTTP/1.0 401 Unauthorized');
        // Fallback message when the user presses cancel / escape
        echo 'Access denied';
      exit;
    }
}
</code></pre>

<p>Obviously replace the IP address with the server IP you want to protect and an appropriate username and password.</p>

<p>This will only impact things routed through index.php - you'd still be able to access static html files and such but this works for most PHP apps I've found.</p>

CC BY-SA 3.0
2015-06-26T10:13:08.127Z
if you must down vote an answer, at least give an explanation why...
Steven Grant
CC BY-SA 3.0
2017-10-02T10:04:57.623Z
You can also grab the IP address with `craft.request.ipAddress`
Digital Squid
CC BY-SA 3.0
2015-06-26T09:57:23.100Z
2015-06-26T09:57:23.100Z
Steven Grant
<p>I know this doesn't answer the question, but personally I don't bother; I just add a robots.txt file to stop it getting indexed.</p>

CC BY-SA 3.0
2017-10-02T05:55:43.300Z
2017-10-02T05:55:43.300Z
darylknight
<p>Front-end user features are only available in the Pro edition of Craft.</p>

<p>Seems like the easiest thing to do would be to use <a href="http://www.htaccesstools.com/articles/password-protection/">.htaccess password protection</a> for the site.</p>

CC BY-SA 3.0
2014-08-23T18:21:37.237Z
yea that makes sense, thought maybe there was a more integrated way but .htpassword works fine in this case
Keith Mancuso
CC BY-SA 3.0
2014-08-22T01:56:52.047Z
2014-08-22T01:56:52.047Z
Brad Bell
<p>Im wondering if there is a simple way to password protect  site thats in development using just Craft Personal?</p>

<p>I setup a login page and i got {% requirelogin %} to redirect but it seems with craft personal even the admin cant login via a front end login form?</p>

<p>Do they have to login at /admin and then jump to the front end of the site?</p>

<p>is there an easier way?</p>

CC BY-SA 3.0
2014-08-21T23:57:36.853Z
You don't want to use .htaccess?
Brad Bell
<password>
How do you password protect a site in progress?
# How do you password protect a site in progress?

(Asked by: username_0 on 2014-08-21)

Im wondering if there is a simple way to password protect site thats in development using just Craft Personal?

I setup a login page and i got {% requirelogin %} to redirect but it seems with craft personal even the admin cant login via a front end login form?

Do they have to login at /admin and then jump to the front end of the site?

is there an easier way?

**Tags:** password
> **Comments:**
> **username_1**: You don't want to use .htaccess?  

---

## 4 answers

### Answer by username_1 on 2014-08-22. Score: 9 | Accepted answer

Front-end user features are only available in the Pro edition of Craft.

Seems like the easiest thing to do would be to use [.htaccess password protection](http://www.htaccesstools.com/articles/password-protection/) for the site.

> **Comments:**
> **username_0**: yea that makes sense, thought maybe there was a more integrated way but .htpassword works fine in this case  

---

### Answer by username_2 on 2017-09-22. Score: 5

I just released a plugin to solve this problem. No apache/nginx needed, just a simple plugin to install directly in Craft.

<https://github.com/dgrigg/knockknock>

> **Comments:**
> **username_3**: Derrick are there any plans to add support for Craft 3? Would appreciate it.  

---

### Answer by username_4 on 2015-06-26. Score: 3

I hate messing with .htaccess files across multiple environments. I also find .htaccess a bit of black magic as I don't understand regex :)
So here's my approach.
In index.php - right after the opening PHP tag - drop this in:
if($_SERVER['SERVER_ADDR'] == '127.0.0.1') {

  $username = 'username';
    $password = 'password';

  if (!(isset($_SERVER['PHP_AUTH_USER']) && ($_SERVER['PHP_AUTH_USER']==$username && $_SERVER['PHP_AUTH_PW']==$password)))  {
        header('WWW-Authenticate: Basic realm="This site is protected"');
        header('HTTP/1.0 401 Unauthorized');
        // Fallback message when the user presses cancel / escape
        echo 'Access denied';
      exit;
    }
}

Obviously replace the IP address with the server IP you want to protect and an appropriate username and password.
This will only impact things routed through index.php - you'd still be able to access static html files and such but this works for most PHP apps I've found.

> **Comments:**
> **username_4**: if you must down vote an answer, at least give an explanation why...  
> **username_5**: You can also grab the IP address with `craft.request.ipAddress`  

---

### Answer by username_6 on 2017-10-02. Score: 1

I know this doesn't answer the question, but personally I don't bother; I just add a robots.txt file to stop it getting indexed.


---

