Im wondering if there is a simple way to password protect site thats in development using just Craft Personal?

I setup a login page and i got {% requirelogin %} to redirect but it seems with craft personal even the admin cant login via a front end login form?

Do they have to login at /admin and then jump to the front end of the site?

is there an easier way?

  • You don't want to use .htaccess?
    – Brad Bell
    Commented Aug 21, 2014 at 23:57

4 Answers 4


Front-end user features are only available in the Pro edition of Craft.

Seems like the easiest thing to do would be to use .htaccess password protection for the site.

  • yea that makes sense, thought maybe there was a more integrated way but .htpassword works fine in this case Commented Aug 23, 2014 at 18:21

I just released a plugin to solve this problem. No apache/nginx needed, just a simple plugin to install directly in Craft.


  • Derrick are there any plans to add support for Craft 3? Would appreciate it. Commented Oct 8, 2018 at 5:58

I hate messing with .htaccess files across multiple environments. I also find .htaccess a bit of black magic as I don't understand regex :)

So here's my approach.

In index.php - right after the opening PHP tag - drop this in:

if($_SERVER['SERVER_ADDR'] == '') {

  $username = 'username';
    $password = 'password';

  if (!(isset($_SERVER['PHP_AUTH_USER']) && ($_SERVER['PHP_AUTH_USER']==$username && $_SERVER['PHP_AUTH_PW']==$password)))  {
        header('WWW-Authenticate: Basic realm="This site is protected"');
        header('HTTP/1.0 401 Unauthorized');
        // Fallback message when the user presses cancel / escape
        echo 'Access denied';

Obviously replace the IP address with the server IP you want to protect and an appropriate username and password.

This will only impact things routed through index.php - you'd still be able to access static html files and such but this works for most PHP apps I've found.

  • 2
    if you must down vote an answer, at least give an explanation why... Commented Jun 26, 2015 at 10:13
  • 1
    Would indeed have been nice. Voted it up to get you back at 0 since this would also work for nginx.
    – user155
    Commented Jun 26, 2015 at 15:04
  • 1
    You can also grab the IP address with craft.request.ipAddress Commented Oct 2, 2017 at 10:04

I know this doesn't answer the question, but personally I don't bother; I just add a robots.txt file to stop it getting indexed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.