<p>I've actually done this a couple of times... a very simple "password-only" page. Then there would be a large group of people who share that same password, and can gain access to that protected page.</p>

<blockquote>
  <p><strong>Disclaimer:</strong> This example was built using the <a href="https://github.com/lindseydiloreto/craft-businesslogic">Business Logic plugin template</a>.</p>
</blockquote>

<p>There are many ways to manage your password, but it sounds like you'll want something as simple as a Global field. Create a Global field for your password, and keep track of the <strong>Global Set ID</strong> and the <strong>field handle</strong> (you'll need that info in a minute).</p>

<p>On your secure page, you'll want something like this:</p>

<pre class="lang-html prettyprint-override"><code>{% if craft.businessLogic.accessGranted %}

    &lt;!-- Your page content goes here --&gt;

{% else %}

    &lt;h1&gt;Enter your access code:&lt;/h1&gt;
    {% if error is defined %}
        &lt;p class="error"&gt;{{ error }}&lt;/p&gt;
    {% endif %}
    &lt;form method="post" action="" accept-charset="UTF-8"&gt;
        &lt;input type="hidden" name="action" value="businessLogic/authorize"&gt;
        &lt;input type="text" name="pw" value=""&gt;
        &lt;input type="submit" value="Log In"&gt;
    &lt;/form&gt;

{% endif %}
</code></pre>

<p>Upon submitting that form, your plugin's <strong>Controller</strong> will authenticate the user, and set a cookie to remember the user.</p>

<p>Something like this for your plugin's Controller:</p>

<pre class="lang-php prettyprint-override"><code>&lt;?php
namespace Craft;

class BusinessLogicController extends BaseController
{
    protected $allowAnonymous = true;

    // Login authorization action
    public function actionAuthorize()
    {
        // Get password
        $pwSubmitted = craft()-&gt;request-&gt;getPost('pw');

        // Check access
        if ($this-&gt;_validPassword($pwSubmitted)) {

            // Set access cookie
            $expires = time() + (60*60*24*7); // One week
            setcookie(md5('cookieNameToBeHashed'), 1, $expires, '/');

            // Redirect
            $this-&gt;redirect(craft()-&gt;request-&gt;getPath());

        } else {

            // Output error message
            craft()-&gt;urlManager-&gt;setRouteVariables(array(
                'error' =&gt; 'Invalid access code'
            ));

        }

    }

    // Check if password is valid
    private function _validPassword($pwSubmitted)
    {
        // Get global set
        $globalSet = craft()-&gt;globals-&gt;getSetById(156);

        // Get target password
        $pwTarget = $globalSet-&gt;passwordFieldhandle;

        // Return whether password matches
        return ($pwSubmitted === $pwTarget);
    }

}
</code></pre>

<p>Your plugin's <strong>Variable</strong> can check if the user is already authorized.</p>

<p>Something like this for your plugin's Variable:</p>

<pre class="lang-php prettyprint-override"><code>&lt;?php
namespace Craft;

class BusinessLogicVariable
{

    // Check if access cookie is set
    public function accessGranted()
    {
        $cookieName = md5('cookieNameToBeHashed');
        return array_key_exists($cookieName, $_COOKIE);
    }

}
</code></pre>

<p>Which of course, brings it full circle. Your secure page will check if <code>accessGranted</code> before showing either the secure content, or the login form.</p>

CC BY-SA 3.0
2015-02-24T19:02:04.503Z
Great little plugin this is, thanks Lindsey!
carlcs
CC BY-SA 3.0
2015-02-24T20:04:13.020Z
Thanks @carlcs! I would probably just bundle this up into a ready-to-go plugin, but there are way too many unique use-cases for something along these lines.
Lindsey D
CC BY-SA 3.0
2015-09-24T21:17:16.333Z
wonderfully simple approach.
Niall Thompson
CC BY-SA 3.0
2015-02-24T18:39:19.977Z
2015-03-30T12:23:16.540Z
2015-03-30T12:23:16.540Z
Lindsey D
<p>The easiest way I have found to password protect page content is as follows:</p>

<pre><code>{% if craft.request.getParam('password') == 'password_you_want' %}
    &lt;h2&gt;This is your content&lt;/h2&gt;
{% else %}
    &lt;h2&gt;Not authorized&lt;/h2&gt;
    &lt;form action="{{ craft.request.getUrl() }}" method="POST" accept-charset="utf-8" class="form-inline"&gt;
        {{ getCsrfInput() }}
        &lt;input type="password" name="password" value=""&gt;
        &lt;button type="submit"&gt;Submit&lt;/button&gt;
    &lt;/form&gt;
{% endif %}
</code></pre>

<p>You put your password protected content in the first half of the if loop and the second half of the loop appears the first time you load the page; prompting you with a password form that resubmits to the same page looking for the correct 'password_you_want'.</p>

<p>Sometimes simple is best.</p>

CC BY-SA 3.0
2015-10-31T21:15:47.590Z
@Jozo: I'd recommend you [ask a new question](http://craftcms.stackexchange.com/questions/ask) about that, since the answer is probably too long to put into comments. Feel free to link back to this thread for reference.
Lindsey D
CC BY-SA 3.0
2015-11-01T14:51:43.497Z
The "password_you_want" could be set within a text field of the entry itself.
Allan Kukral
CC BY-SA 3.0
2015-08-14T18:42:50.490Z
2015-08-15T15:51:11.890Z
2015-08-15T15:51:11.890Z
Allan Kukral
<p>I’ve done this a few times before and this is how I usually get it done.</p>

<p><strong>Set Per Entry Password</strong></p>

<p>Within Craft create a new Plain Text field for the entry you would like password protected. The password for the entry can be a phrase, random string of numbers and letters, whatever.</p>

<p><strong>Create a Login Template</strong></p>

<p>In Craft, set up a route to the login template including the slug of the page you are password protecting. For example, blog/{slug}/login.</p>

<p>Within your login template create a form that:</p>

<ul>
<li>Contains a field for your password</li>
<li>Posts to itself</li>
</ul>

<p>It should look something like this:</p>

<pre><code>&lt;form id="check-code" action="/{{ craft.request. getPath() }}" method="POST"&gt;
    &lt;input type="text" name="access-code" id="access-code" /&gt;
    &lt;input type="submit" value="Submit" class="submit" /&gt;
&lt;/form&gt;
</code></pre>

<p><strong>Check Form Submission against Entry’s Password</strong></p>

<p>Within the login template wrap the form in a conditional that checks for the password field’s POST value when the page is reloaded following successful form submission (I use Parsley for pre-submission form validation).</p>

<pre><code>    {% if craft.request.getPost('access-code') %}

    {% else %}

        &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
            …
        &lt;/form&gt;

    {% endif %}
</code></pre>

<p>Now, select the entry using craft.request.getSegment() and compare its password field against the post data from our form submission. If they don’t match then create a duplicate of our form from below with some kind of error message (I’m sure there’s a way to include the forms, without repeating markup using a macro or something). This allows the user to try again if they got it wrong.</p>

<pre><code>    {% if craft.request.getPost('access-code') %}

        {% set entry = craft.entries.section({entrySection}).slug(craft.request.getSegment(2)).first() %}

        {% if entry.passwordField == craft.request.getPost('access-code') %}    

        {% else %}

            &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
                &lt;p&gt;Your access code was incorrect&lt;/p&gt;
                &lt;input type="text" name="access-code" id="access-code" /&gt;
                &lt;input type="submit" value="Submit" /&gt;
            &lt;/form&gt;

        {% endif %}

    {% else %}

        &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
            …
        &lt;/form&gt;

    {% endif %}
</code></pre>

<p>Now, if the password and the post data do much we need to set a cookie and redirect the user to the entry’s template. In order to set the cookie, I’m using Andrew Welch’s <a href="https://github.com/khalwat/cookies" rel="nofollow noreferrer">Cookies plugin</a>. In this case I’m setting the cookie to expire with the current browser session, but you can set it to be whatever you want following <a href="http://php.net/manual/en/function.setcookie.php" rel="nofollow noreferrer">PHP’s set cookie parameters</a>.</p>

<pre><code>    {% if craft.request.getPost('access-code') %}

        {% set entry = craft.entries.section({entrySection}).slug(craft.request.getSegment(2)).first() %}

        {% if entry.passwordField == craft.request.getPost('access-code') %}

            {{ setCookie( craft.request.getSegment(2), entry.passwordField, 0, "/") }}
            {% redirect "blog/"~craft.request.getSegment(2) %}

        {% else %}

            &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
                …
            &lt;/form&gt;

        {% endif %}

    {% else %}

        &lt;form action="/{{ craft.request. getPath() }}" method="POST"&gt;
            …
        &lt;/form&gt;

    {% endif %}
</code></pre>

<p><strong>Check for Cookie in Entry’s template</strong></p>

<p>At the top of your entry template check if the entry has a password set and if the browser does not have a cookie set, whose name matches the entry’s slug and whose value matches the entry’s password. If those conditions are met then the user has not logged in and will be redirected to the login page. Otherwise, the template will continue loading and the user will see the entry template.</p>

<pre><code>{% if (entry.passwordField != "") and (getCookie( entry.slug ) != entry.passwordField) %}

    {% redirect "blog/"~entry.slug~"/login" %}

{% endif %}
</code></pre>

<p><strong>Bonus</strong></p>

<p>Once you’ve tested out that this process is working you, or other credentialed site users, may not want to have to enter in the password each time. Simply add another conditional to the entry template’s password/cookie check.</p>

<pre><code>{% if (entry.passwordField != "") and (getCookie( entry.slug ) != entry.passwordField) and (currentUser == false) %}

    {% redirect "blog/"~entry.slug~"/login" %}

{% endif %}
</code></pre>

<p>Now, if the user is logged in to the site the conditional will be bypassed and they will be able to see the content without getting redirected to the login page.</p>

<p>This is pulled from a <a href="https://noahread.net/blog/create-password-protected-pages-in-craft" rel="nofollow noreferrer">blog post</a> I wrote a while ago.</p>

CC BY-SA 3.0
2017-12-01T15:13:59.343Z
2017-12-01T15:13:59.343Z
noahread
<p>Is it possible to protect a page with a single password? Instead of using crafts user features, can I allow an admin to set a specific password from the edit page? When a user visits that page, they have to type in that password to view its content. </p>

<p>We aren't protecting anything that requires a high level of security. But we would like to prohibit access from any old visitor. </p>

<p>One possibility I'm considering is to have a password text field associated with that entry. Then when the user submit the login form, we can do a simple logic check to see if the password is valid. If so, we can set a “logged-in” status to either a PHP session or a cookie. </p>

<p><a href="https://github.com/lewisjenkins/craft-lj-cookies">https://github.com/lewisjenkins/craft-lj-cookies</a></p>

<p><a href="https://github.com/stuartalexwhitehead/remember">https://github.com/stuartalexwhitehead/remember</a></p>

<p>I wonder if anyone else in the Craft community has tried to implement something like this. </p>

CC BY-SA 3.0
2015-02-24T03:49:41.367Z
Sorry if I'm being master of the obvious, but wouldn't it be easiest to just set up a dummy user account in a group with otherwise very limited access, that you can give out freely.
Douglas McDonald
CC BY-SA 3.0
2015-02-24T10:27:14.373Z
Yep, *"set up a dummy user account"* is probably the easiest way, but not possible without a Craft Pro licence.
carlcs
<plugins><password><login>
Protect a page with a single password?
# Protect a page with a single password?

(Asked by: username_0 on 2015-02-24)

Is it possible to protect a page with a single password? Instead of using crafts user features, can I allow an admin to set a specific password from the edit page? When a user visits that page, they have to type in that password to view its content.

We aren't protecting anything that requires a high level of security. But we would like to prohibit access from any old visitor.

One possibility I'm considering is to have a password text field associated with that entry. Then when the user submit the login form, we can do a simple logic check to see if the password is valid. If so, we can set a “logged-in” status to either a PHP session or a cookie.

<https://github.com/lewisjenkins/craft-lj-cookies>

<https://github.com/stuartalexwhitehead/remember>

I wonder if anyone else in the Craft community has tried to implement something like this.

**Tags:** plugins, password, login
> **Comments:**
> **username_1**: Sorry if I'm being master of the obvious, but wouldn't it be easiest to just set up a dummy user account in a group with otherwise very limited access, that you can give out freely.  
> **username_2**: Yep, *"set up a dummy user account"* is probably the easiest way, but not possible without a Craft Pro licence.  

---

## 3 answers

### Answer by username_3 on 2015-02-24. Score: 18

I've actually done this a couple of times... a very simple "password-only" page. Then there would be a large group of people who share that same password, and can gain access to that protected page.

Disclaimer: This example was built using the Business Logic plugin template.

There are many ways to manage your password, but it sounds like you'll want something as simple as a Global field. Create a Global field for your password, and keep track of the Global Set ID and the field handle (you'll need that info in a minute).
On your secure page, you'll want something like this:
{% if craft.businessLogic.accessGranted %}

    

{% else %}

    Enter your access code:
    {% if error is defined %}
        {{ error }}
    {% endif %}
    
        
        
        
    

{% endif %}

Upon submitting that form, your plugin's Controller will authenticate the user, and set a cookie to remember the user.
Something like this for your plugin's Controller:
request->getPost('pw');

        // Check access
        if ($this->_validPassword($pwSubmitted)) {

            // Set access cookie
            $expires = time() + (60*60*24*7); // One week
            setcookie(md5('cookieNameToBeHashed'), 1, $expires, '/');

            // Redirect
            $this->redirect(craft()->request->getPath());

        } else {

            // Output error message
            craft()->urlManager->setRouteVariables(array(
                'error' => 'Invalid access code'
            ));

        }

    }

    // Check if password is valid
    private function _validPassword($pwSubmitted)
    {
        // Get global set
        $globalSet = craft()->globals->getSetById(156);

        // Get target password
        $pwTarget = $globalSet->passwordFieldhandle;

        // Return whether password matches
        return ($pwSubmitted === $pwTarget);
    }

}

Your plugin's Variable can check if the user is already authorized.
Something like this for your plugin's Variable:

Which of course, brings it full circle. Your secure page will check if accessGranted before showing either the secure content, or the login form.

> **Comments:**
> **username_2**: Great little plugin this is, thanks Lindsey!  
> **username_3**: Thanks @carlcs! I would probably just bundle this up into a ready-to-go plugin, but there are way too many unique use-cases for something along these lines.  
> **username_4**: wonderfully simple approach.  

---

### Answer by username_5 on 2015-08-14. Score: 13

The easiest way I have found to password protect page content is as follows:
{% if craft.request.getParam('password') == 'password_you_want' %}
    This is your content
{% else %}
    Not authorized
    
        {{ getCsrfInput() }}
        
        Submit
    
{% endif %}

You put your password protected content in the first half of the if loop and the second half of the loop appears the first time you load the page; prompting you with a password form that resubmits to the same page looking for the correct 'password_you_want'.
Sometimes simple is best.

> **Comments:**
> **username_3**: @Jozo: I'd recommend you [ask a new question](http://craftcms.stackexchange.com/questions/ask) about that, since the answer is probably too long to put into comments. Feel free to link back to this thread for reference.  
> **username_5**: The "password_you_want" could be set within a text field of the entry itself.  

---

### Answer by username_6 on 2017-12-01. Score: 3

I’ve done this a few times before and this is how I usually get it done.
Set Per Entry Password
Within Craft create a new Plain Text field for the entry you would like password protected. The password for the entry can be a phrase, random string of numbers and letters, whatever.
Create a Login Template
In Craft, set up a route to the login template including the slug of the page you are password protecting. For example, blog/{slug}/login.
Within your login template create a form that:

Contains a field for your password
Posts to itself

It should look something like this:

    
    


Check Form Submission against Entry’s Password
Within the login template wrap the form in a conditional that checks for the password field’s POST value when the page is reloaded following successful form submission (I use Parsley for pre-submission form validation).
    {% if craft.request.getPost('access-code') %}

    {% else %}

        
            …
        

    {% endif %}

Now, select the entry using craft.request.getSegment() and compare its password field against the post data from our form submission. If they don’t match then create a duplicate of our form from below with some kind of error message (I’m sure there’s a way to include the forms, without repeating markup using a macro or something). This allows the user to try again if they got it wrong.
    {% if craft.request.getPost('access-code') %}

        {% set entry = craft.entries.section({entrySection}).slug(craft.request.getSegment(2)).first() %}

        {% if entry.passwordField == craft.request.getPost('access-code') %}    

        {% else %}

            
                Your access code was incorrect
                
                
            

        {% endif %}

    {% else %}

        
            …
        

    {% endif %}

Now, if the password and the post data do much we need to set a cookie and redirect the user to the entry’s template. In order to set the cookie, I’m using Andrew Welch’s Cookies plugin. In this case I’m setting the cookie to expire with the current browser session, but you can set it to be whatever you want following PHP’s set cookie parameters.
    {% if craft.request.getPost('access-code') %}

        {% set entry = craft.entries.section({entrySection}).slug(craft.request.getSegment(2)).first() %}

        {% if entry.passwordField == craft.request.getPost('access-code') %}

            {{ setCookie( craft.request.getSegment(2), entry.passwordField, 0, "/") }}
            {% redirect "blog/"~craft.request.getSegment(2) %}

        {% else %}

            
                …
            

        {% endif %}

    {% else %}

        
            …
        

    {% endif %}

Check for Cookie in Entry’s template
At the top of your entry template check if the entry has a password set and if the browser does not have a cookie set, whose name matches the entry’s slug and whose value matches the entry’s password. If those conditions are met then the user has not logged in and will be redirected to the login page. Otherwise, the template will continue loading and the user will see the entry template.
{% if (entry.passwordField != "") and (getCookie( entry.slug ) != entry.passwordField) %}

    {% redirect "blog/"~entry.slug~"/login" %}

{% endif %}

Bonus
Once you’ve tested out that this process is working you, or other credentialed site users, may not want to have to enter in the password each time. Simply add another conditional to the entry template’s password/cookie check.
{% if (entry.passwordField != "") and (getCookie( entry.slug ) != entry.passwordField) and (currentUser == false) %}

    {% redirect "blog/"~entry.slug~"/login" %}

{% endif %}

Now, if the user is logged in to the site the conditional will be bypassed and they will be able to see the content without getting redirected to the login page.
This is pulled from a blog post I wrote a while ago.


---

