PHPackages jorisnoo/statamic-password-protect - PHPackages - PHPackages [Skip to content](#main-content)[PHPackages](/)[Directory](/)[Categories](/categories)[Trending](/trending)[Leaderboard](/leaderboard)[Changelog](/changelog)[Analyze](/analyze)[Collections](/collections)[Log in](/login)[Sign up](/register) 1. [Directory](/) 2. / 3. [Authentication & Authorization](/categories/authentication) 4. / 5. jorisnoo/statamic-password-protect ActiveStatamic-addon[Authentication & Authorization](/categories/authentication) jorisnoo/statamic-password-protect ================================== Site-wide password protection for anonymous visitors 0.1.0(4mo ago)081↓90%MITPHPPHP ^8.3CI passing Since Mar 23Pushed 4w agoCompare [ Source](https://github.com/jorisnoo/statamic-password-protect)[ Packagist](https://packagist.org/packages/jorisnoo/statamic-password-protect)[ RSS](/packages/jorisnoo-statamic-password-protect/feed)WikiDiscussions main Synced 4w ago READMEChangelog (1)Dependencies (3)Versions (2)Used By (0) Statamic Password Protect ========================= [](#statamic-password-protect) Site-wide password protection for Statamic 6. Anonymous visitors must enter a password to view the site. Logged-in CP users always bypass the wall. Settings are managed through the addon settings page in the Statamic control panel. Requirements ------------ [](#requirements) - PHP 8.3+ - Statamic 6.24.2+ - Laravel 12.40+ or 13 Installation ------------ [](#installation) ``` composer require jorisnoo/statamic-password-protect ``` Configuration ------------- [](#configuration) 1. Go to **CP > Addons > Password Protect > Settings** 2. Toggle **Enabled** on 3. Set a **Password** of at least 12 characters 4. Optionally set a **Title** for the password page (defaults to your site name) 5. Save That's it. Anonymous visitors will now see a password prompt. Authenticated CP users are never affected. How It Works ------------ [](#how-it-works) A middleware intercepts frontend requests and Statamic's REST API, GraphQL, and HTTP-served Glide routes. It checks (in order): 1. Is password protection enabled with a password set? If not, pass through. 2. Is this the exact CP route or one of its child segments? Pass through. 3. Is this the password form itself? Pass through. 4. Is the visitor logged into Statamic with the `access cp` permission? Pass through. 5. Does the session or HttpOnly authorization cookie contain a fingerprint for the current password and authorization generation? Pass through. 6. Otherwise, redirect to the password form. After entering the correct password, visitors are redirected back to the page they originally requested. Authorization persists for the browser session. Changing the password or disabling and re-enabling protection invalidates every existing authorization. Protected responses are marked `private, no-store` so reverse proxies and browsers do not reuse an authorized response for another visitor. Passwords are stored as one-way hashes. Existing plaintext settings from earlier addon versions are migrated automatically the next time the addon boots. The password hash is never preloaded into the control panel form. Password verification is limited to five attempts per IP address per minute, with an additional global limit of 100 attempts per minute. Static Caching -------------- [](#static-caching) When password protection is enabled, the addon clears Statamic's existing static cache before disabling the static caching strategy. This removes previously generated full-measure files before nginx or Apache can serve them and ensures new requests pass through the middleware. When you disable password protection, the original static caching strategy is restored. This also works with long-running application workers. Files that are deliberately exposed directly from `public/` are outside PHP and cannot be protected by this addon. Keep sensitive source assets outside public storage and serve them through a protected application route or authenticated storage layer. **SSG (Static Site Generator):** This addon is not compatible with `statamic/ssg`. If you're generating a fully static site, password protection must be handled at the web server level (e.g., HTTP Basic Auth via nginx/Apache). Testing ------- [](#testing) ``` composer test ``` License ------- [](#license) The MIT License (MIT). Please see [License File](LICENSE) for more information. ### Health Score 38 — LowBetter than 83% of packages Maintenance86 Actively maintained with recent releases Popularity11 Limited adoption so far Community9 Small or concentrated contributor base Maturity39 Early-stage or recently created project Bus Factor1 Top contributor holds 77.8% of commits — single point of failure How is this calculated?**Maintenance (25%)** — Last commit recency, latest release date, and issue-to-star ratio. Uses a 2-year decay window. **Popularity (30%)** — Total and monthly downloads, GitHub stars, and forks. Logarithmic scaling prevents top-heavy scores. **Community (15%)** — Contributors, dependents, forks, watchers, and maintainers. Measures real ecosystem engagement. **Maturity (30%)** — Project age, version count, PHP version support, and release stability. ### Release Activity Cadence Unknown Total 1 Last Release 138d ago ### Community Maintainers ![](https://www.gravatar.com/avatar/0440b6ac994d5566a2ef5886fbac104a73f8458e70dbd20085e241ab0f647e0d?d=identicon)[jorgenoo](/maintainers/jorgenoo) --- Top Contributors [![jorisnoo](https://avatars.githubusercontent.com/u/5810772?v=4)](https://github.com/jorisnoo "jorisnoo (7 commits)")[![dependabot[bot]](https://avatars.githubusercontent.com/in/29110?v=4)](https://github.com/dependabot[bot] "dependabot[bot] (1 commits)")[![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?v=4)](https://github.com/github-actions[bot] "github-actions[bot] (1 commits)") ### Code Quality TestsPest ### Embed Badge ![Health badge](/badges/jorisnoo-statamic-password-protect/health.svg) ``` [![Health](https://phpackages.com/badges/jorisnoo-statamic-password-protect/health.svg)](https://phpackages.com/packages/jorisnoo-statamic-password-protect) ``` ### Alternatives [statamic-rad-pack/runway Eloquently manage your database models in Statamic. 137236.2k8](/packages/statamic-rad-pack-runway)[statamic/seo-pro 71548.3k](/packages/statamic-seo-pro)[statamic/statamic Statamic 830182.1k](/packages/statamic-statamic)[duncanmcclean/statamic-cargo Comprehensive e-commerce addon for Statamic. Build bespoke e-commerce sites without the complexity. 3618.3k](/packages/duncanmcclean-statamic-cargo)[statamic/eloquent-driver Allows you to store Statamic data in a database. 128790.9k20](/packages/statamic-eloquent-driver)[rias/statamic-redirect 29347.4k](/packages/rias-statamic-redirect) PHPackages © 2026 [Directory](/)[Categories](/categories)[Trending](/trending)[Changelog](/changelog)[Analyze](/analyze)