Full-featured password protection plugin for EmDash CMS — global and per-content access control with brute-force protection, CAPTCHA, bypass links, analytics, and a fully customisable lock screen.

• Global & per-content protection — lock the entire site, individual pages, posts, categories, or the homepage
• Multiple passwords per resource — assign several passwords to one piece of content; require any one or all of them
• One-time & usage-limited passwords — automatically invalidate after N uses or a single unlock
• Expiring passwords — set an ISO datetime after which a password stops working
• Bypass tokens — generate secret access links and QR codes that skip the lock screen entirely
• Brute-force protection — configurable failed-attempt limit and IP lockout duration
• CAPTCHA support — reCAPTCHA v2/v3 and hCaptcha integrations
• IP whitelist / blacklist — always-allow or always-block specific addresses and CIDR ranges
• Remember-me sessions — configurable cookie lifetime so returning visitors stay unlocked
• Maintenance mode — take the site offline for all visitors instantly
• Fully customisable lock screen — title, logo, background colour, button colour, font colour, background image, dark mode, and custom CSS
• Redirect after unlock — send visitors to a specific URL after a successful unlock
• Email alerts — get notified when suspicious activity is detected
• Access logs — full audit trail of unlock attempts (list, clear, export as CSV)
• Analytics — summary stats and recent-event timeline for every protected resource
• Admin dashboard widget — at-a-glance protection status on your EmDash dashboard

npm install @6arshid/plugin-password-protected-em
# or
pnpm add @6arshid-cms/plugin-password-protected-em

// live.config.ts
import { passwordProtectedPlugin } from "@6arshid/plugin-password-protected-em";

export default defineConfig({
  plugins: [passwordProtectedPlugin()],
});

That's it. The plugin registers its admin pages, dashboard widget, and public API endpoints automatically.

Pass options to the constructor to control behaviour at the code level.

passwordProtectedPlugin({
  publicApi: true, // default
})

All other settings are configured through the EmDash admin panel under Password Protection → Settings. No code changes needed.

Each password record supports the following fields, managed from Password Protection → Passwords in the admin:

Protect individual pieces of content from the EmDash content editor. Each configuration supports:

• Selecting which passwords apply to that content
• Require any (default) — visitor needs to satisfy any one of the assigned passwords
• Require all — visitor must unlock every assigned password

When publicApi is enabled (the default), the plugin exposes the following visitor-facing routes:

All admin routes (password CRUD, access logs, analytics, brute-force management) require authentication and are only accessible to logged-in EmDash users.

The plugin adds the following pages to the EmDash admin panel:

A Password Protection dashboard widget is also added to the main EmDash dashboard.

This plugin declares the following EmDash capability requirements:

Allowed outbound hosts: www.google.com (reCAPTCHA), hcaptcha.com.

MIT © 2024 EmDash Contributors

6arshid

Hassan Tafreshi

Amin Khadivar

Repository: https://github.com/6arshid/password-protected-em