Protecting Content

Overview#

You may deny front-end access to your content on a per-page, per-collection, or site-wide basis.

There are a number of drivers for protecting content available out of the box:

• auth for only allowing authenticated users.
• ip_address for allowing specific IP addresses.
• password will force users to enter a specified password.

You can also create your own drivers.

Whichever approach you choose, know that it's designed to help you out. We’ve tried to keep the syntax as simple as possible while allowing for flexibility. Because of this, if Statamic sees you’ve set protect, but the scheme has been configured incorrectly, all users will be denied.

Caveats#

• Protection only applies to the frontend of your site routed through Statamic (like entry URLs). Custom routes defined in your routes/web.php file and the Control Panel will be unaffected.
• Protected pages are automatically excluded from the static cache, unless the driver explicitly opts in by marking itself cacheable.

Protecting an entry#

To protect an entry, add a protect variable with a corresponding scheme name.

For example, Statamic comes pre-configured with a logged_in protection scheme that only shows the content to authenticated users. You might have an entry like this:

---
title: Members Only
protect: logged_in
---
When visiting this entry's URL, logged in users will see it,
but logged out users will be redirected to a login page.

Protecting a collection#

To protect an entire collection, inject a protect variable into your collection. To do this, add the following to your collection's YAML config file. This cannot be done in the control panel.

---
inject:
  protect: logged_in

Configuring schemes#

The configuration file is located at config/statamic/protect.php. In this file you may specify a number of different schemes which you can reference throughout your content files.

You are free to use the same driver in multiple schemes, configured in different ways. Check below for details on how to configure each driver.

IP address#

Add the IP address(es) you wish to allow to the aptly named allowed array.

'ip_address' => [
    'driver' => 'ip_address',
    'allowed' => ['127.0.0.1', '192.168.0.10'],
]

Authentication#

Adding this scheme to a page will redirect to a login page unless the user is already logged in as a Statamic user.

'logged_in' => [
    'driver' => 'auth',
    'login_url' => '/login',
    'append_redirect' => true,
]

If the login_url has not been defined the user will see an “Access Denied” page instead of a login screen. In this case, the user could log in through the Control Panel and then come back.

The append_redirect setting will add ?redirect=/the-protected-url to your login_url. This pairs with the user:login_form tag’s allow_request_redirect parameter which will redirect the user to the intended page once successfully logged in.

This protection method does not take into account any user roles. They are simply either logged in or they're not.

Password#

This is perfect for times when you want to password-protect one or more files but don’t want to set up user accounts for this one purpose. This scheme does not relate to member accounts in any way.

'password' => [
    'driver' => 'password',
    'allowed' => ['secret', 'confidential'],
    'form_url' => null,
]

You can also define the password for a protected entry on the entries themselves. This might be helpful if each has a different password.

# content/collections/pages/secret-page.md

protect: password
password: local-password

 // config/statamic/protect.php
 
 'password' => [
     'driver' => 'password',
     'allowed' => ['secret', 'confidential'],
     'form_url' => null,
+    'field' => 'password', 
 ]

Password form#

You’ll need to provide a way for people to enter passwords for URLs. Statamic has a built-in generic password entry form. If you want to customize it, you have two options:

Override the view#

{{ protect:password_form }}
    {{ if no_token }}
        No token has been provided.
    {{ else }}

        {{ if error }}
            <div class="error">{{ error }}</div>
        {{ /if }}

        <input type="password" name="password" />

        {{ errors:password }}
            <div class="inline-error">{{ value }}</div>
        {{ /errors:password }}

        <button>Submit</button>

    {{ /if }}
{{ /protect:password_form }}

<s:protect:password_form>
  @if ($no_token)
    No token has been provided.
  @else
    @if ($error)
      <div class="error">{{ $error }}</div>
    @endif

    <input type="password" name="password" />