I don't know if there even is a way to do this using Craft CMS:

I am looking for some sort of a password protected redirect. domain.com should show a password mask that accepts multiple different passwords, each valid password will redirect the user to another entry. These entries should otherwise not be accessible, even when using direct links. If a visitor accesses a direct link to a entry, it should redirect him to the login mask.

Example: If the password admin is typed in, a user would be redirected to a specific entry domain.com/admin, whilst the password clientname may lead to another specific entry domain.com/client.

Use case in detail: Planned is a file/entry sharing hub. A client should be able to access domain.com and after "logging in" using his individual access code see all the entries assigned to him. Those entries can only be accessed after "logging in".

Maybe I am thinking waaay to far and should just be doing a simple User System using Craft Pro?

1 Answer 1


There are several approaches to building this feature. It really depends a lot on your more concrete requirements and constraints.

Basic solution with user accounts

You can get this behaviour with almost no custom code by using the built-in user account system. In this scenario, all your clients (and the admin as well) will get their own user accounts to the CMS and log in with their username and password. To get started, include a frontend login form on the homepage - see the linked knowledge base article for details.

Validation, authentication and error handling are all taken care of by either the controller method used by the form or by the form template.

After a successful login, you can control where the user is redirected using the loginPath setting. You can use this in two ways:

  • Set it to a static route like /my-content and just show contents for the logged-in user there.
  • You can set the path to a function that gets called every time the login path is needed. In this function, you can write custom logic to determine the right place to redirect the current user to. For example, by finding an entry that is associated with that user account and redirecting to that.

Advanced solution with a custom controller

If you can't or don't want to use regular user accounts, you can also built your own endpoint for validating passwords and redirecting to the appropriate place. First, create a module to hold your custom logic. Inside that module, create a controller with a controller action for processing password inputs. The action should do the following things:

  • Check if the password belongs to a valid data set (for example, an entry with a custom password field that matches the given password).
  • Save the information that the current visitor is allowed to access that data set in a way that can't be manipulated from the frontend (for example, in the session).
  • Redirect the user to that data set.

Then you only need a function in your template for datasets to check if the current visitor is allowed to view that dataset. You can make that function available through Twig with a custom Twig extension in your module. If the visitor doesn't have permission, exit with a 404 or 401 status.

You can mix and match those approaches to get the perfect solution to your problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.