Description

Control access to a whole WordPress site or only the parts that need protection. Create ordered policies for domain names and URL paths, then decide whether visitors can enter with a shared password, a WordPress login, or both. Everything is managed in WordPress — no web-server rules required.

A practical fit for

Staging sites and client previews
Private company or team sites
Protected sections within an otherwise public site
Different access requirements for different domain names or URL paths

How policies work

Each request is checked against your enabled policies in order. The first matching policy decides what access is required, so broad rules and narrow exceptions can live together without custom code.

Choose what to protect: the entire site, an exact or wildcard domain name, or a URL path.
Choose how visitors enter: a shared password, their WordPress login, or both.
For WordPress users, optionally allow only selected accounts, roles, or capabilities.
Use the simulator and analyzer to check which policy will apply, then review activity in the audit log.

Included in Free

Unlimited policies with drag-and-drop ordering and revision history
Whole-site, exact domain name, wildcard domain name, and URL path matching
Shared passwords kept in a reusable password vault
WordPress login access for selected users, roles, and capabilities
“Any” or “all” authentication requirements
Scheduled start and end times, plus observe-only policies
Secure access sessions, recovery codes, an audit log, a policy simulator, and an analyzer

Premium is optional

Premium is a separate companion plugin for organizations that need passkeys, access groups, custom sign-in screens, SSO/identity providers, SCIM, agency multisite tools, and other advanced controls. The Free plugin is fully usable on its own and does not lock included features behind a license key.

Compare Free and Premium

Privacy and external services

By default, the plugin does not contact external services. WordPress handles its normal translation updates. Optional integrations that you configure, such as identity providers, SIEM webhooks, and cloud backups, send only the data needed for that service. Password hashes and private keys are never sent to cloud backups.

The plugin supports WordPress’s personal-data export and erasure tools. Audit events are anonymized rather than deleted so the security record remains useful. Shared policies and credentials belonging to other users are not erased.

Read the full privacy notice

Screenshots

Visitor challenge — a clean password or WordPress sign-in screen for protected requests.

Policies — realistic ordered rules for a client preview, team area, and documentation path. — Visitor challenge — a clean password or WordPress sign-in screen for protected requests.

Installation

In WordPress, go to Plugins Add New.
Search for “ncdLabs Site Access Policies”, then select Install Now and Activate.
Open Access Policies in WP Admin and follow the setup guide.
Create a policy and use the simulator to confirm which requests it will match.

For a manual installation, upload the ncdlabs-site-access-policies folder to /wp-content/plugins/, then activate the plugin.

FAQ

Does Free require a license key?: No. Every feature included in the Free plugin works without payment or a license key. Premium is a separate download.
What happens when more than one policy matches?: The first enabled policy that matches the request is used. You can drag policies into the order you want, place specific exceptions above broader rules, and use the simulator to confirm the result.
Can I use the same password for several policies?: Yes. Save a named password once in the password vault and assign it to as many policies as needed. If you rotate that password, every assigned policy uses the replacement.
Does the plugin protect images, downloads, and other files?: The plugin protects requests processed by WordPress. A web server or storage service may deliver static files, including files in the uploads directory, without loading WordPress. Protect sensitive files separately at the server or storage layer.
Does full-page caching affect access policies?: It can. A cached page may be served before WordPress runs the access check. Exclude protected domain names and paths from full-page caching, then clear any existing cached copies. Object caching does not bypass the request check.
How do I unlock Premium after purchase?: Install the Premium companion zip, then add define('WPAPM_PREMIUM_SKU', 'pro'); (or agency / enterprise) to wp-config.php. The plugin does not contact a licensing server. Your purchase confirmation email includes the exact line for your edition.
Does the plugin contact external servers?: Not by default. WordPress handles its normal translation updates. Optional Premium features that you configure, such as identity providers, SIEM webhooks, and cloud backups, send data only to the endpoints you choose.
Where is the source for the admin JavaScript?: Unminified sources live in resources/js/. Build with npm install && npm run build. Development repository: https://git.ncdlabs.com/ncdlabs/ncdlabs-site-access-policies
Is this plugin GPLv2 compatible?: Yes. The plugin is licensed GPLv2 or later. Bundled production libraries are GPL-compatible (MIT/BSD). Self-hosted IBM Plex fonts use the SIL Open Font License.

Reviews

There are no reviews for this plugin.

Contributors & Developers

“ncdLabs Site Access Policies” is open source software. The following people have contributed to this plugin.

someguynamedlou

Translate “ncdLabs Site Access Policies” into your language.

Interested in development?

Browse the code, check out the SVN repository, or subscribe to the development log by RSS.

Changelog

1.0.9

Compatibility: support PHP 8.2 and newer.

1.0.8

Fix: WordPress admin escape hatch opens /wp-admin/ (via admin_url()) instead of bare admin.php.

1.0.7

Fix: alert coach heading now shows a normal apostrophe in “What’s going on”.

1.0.6

Fix: whitelist confirmed WordPress login URL (auto-detect via wp_login_url) so path protection policies requiring login do not redirect-loop.
Policy and Setup wizards ask admins to confirm or enter the site login address; exact-path exemption plus runtime fallback for existing policies.

1.0.5

Security: fail closed on configuration errors without a presentation policy; Premium entitlement defaults fail closed (explicit SKU); truthful cloud backup results.
Fix: auth_mode=all shared completion for WordPress login, password, passkey, IdP, and verified email.
Fix: genuine privacy export/erase; remove plugin-initiated language-pack downloads.
Feature: persist and evaluate scheduled policy starts_at/ends_at (UTC) with admin UI.

1.0.4

WordPress-login-only challenges redirect to wp-login.php (with safe return URL) instead of the HTML challenge page
Policies whose authorization needs a WordPress user automatically include wordpress_login among auth methods
More reliable wp-login.php exemption detection via is_login() / script name (not only REQUEST_URI basename)

1.0.3

Scope UI uses “domain name” wording (exact/wildcard/domain name and path) instead of hostname
Domain / Path Protection setup recipe naming and description
Public challenge password field layout overflow fix
Hardened enforcement exemptions (exact wp-login.php / wp-admin path matching)
Multisite network actions require network admin; safer email-domain JIT roles and IdP outbound URL checks

1.0.2

WordPress.org review follow-up: dbDelta via require_once + immediate call helper; no wholesale $_GET/$_SERVER/$_COOKIE assignment in request context factory
Removed RequestVars get/request helpers; recovery/email-verify use registered query_vars; admin screen detection via get_current_screen; AJAX allowlist uses heartbeat nonce / caps
Custom-table services/migrations declare justified DirectDatabaseQuery phpcs:disable (TableNames allowlist; prepared queries / %i)

1.0.1

WordPress.org review remediations: dbDelta upgrade.php guard, prepared DDL migrations (%i), challenge assets enqueue static fallbacks (no inline CSS/JS)
Clarified read-only request adapters (RequestVars / RequestContextFactory); mutations remain REST + caps + wp_rest nonce

1.0.0

Initial WordPress.org Free release with Premium companion model
Production Decision Engine pipeline (Conditions, Authentication, Authorization, Challenge)
Authorization uses boolean AuthzTree (legacy flat OR migrates on read/write)
Password vault: policies reference vault credentials via password_id (one password, many policies)
Policy Simulator and Evaluation Trace; Support Mode live-trace auto-expires after 1 hour
PePper contextual guidance; design-system admin SPA
Idempotent DB migrations; no required wipe on upgrade

Description

A practical fit for

How policies work

Included in Free

Premium is optional

Privacy and external services

Screenshots

Installation

FAQ

Does Free require a license key?

What happens when more than one policy matches?

Can I use the same password for several policies?

Does the plugin protect images, downloads, and other files?

Does full-page caching affect access policies?

How do I unlock Premium after purchase?

Does the plugin contact external servers?

Where is the source for the admin JavaScript?

Is this plugin GPLv2 compatible?