Password protection

Password protection asks every visitor for a username and a password before showing anything. The browser shows its own sign-in window and, once the password is right, remembers the credentials until the session ends. It is the quickest way to hide a staging copy, a draft or a site that is not finished yet.

Turn it on in the site’s settings under Advanced, Password protection, and fill in the fields:

This protects every page and file of the site. For a single folder, use .htaccess instead (see below).

How the password is kept

The panel stores only an scrypt hash of the password and has no way to show the password again. To change it, type a new one; to keep it, leave the field empty. The settings export carries the hash, so a site moved to another server keeps its password.

Passwords stored in plain text by old versions are converted to a hash when the panel starts.

Checks that do not slow the server down

scrypt is slow on purpose, and the browser sends the password with every request. To keep this from loading the server, WardPane limits the work as follows:

• A new username and password pair is checked off the main thread, so other sites never wait for it.
• At most 2 checks run at once for all site passwords together, and at most 2 can wait in the queue from one visitor (an address, for IPv6 its /64). The panel’s own sign-in has a separate queue, so a flood of guesses on a site can never lock you out of the panel.
• If a check cannot start within 5 seconds, the visitor gets 503 with Retry-After: 5 instead of a new password prompt, so the browser does not forget the password the user typed.
• Results are cached: after the first check, the same correct (or wrong) credentials are answered at once.

After every other filter

The password is checked after all other filters: the blocklist, the rate limit, Bot Fight Mode, Geo-blocking, devices, hotlink protection and required URL parameters. Bots and blocked visitors never even see the sign-in window, and cannot make the server spend time on password checks. Together with DDoS protection, this also limits how fast anyone can guess.

Use HTTPS

HTTP Basic sends the username and password with every request in Base64, which anyone on the way can decode. Use it only over HTTPS (turn on the HTTP to HTTPS redirect for the site) and do not reuse an important password here.

The password is not passed on to PHP scripts.

Protecting one folder with .htaccess

To protect only part of a site, for example /admin/, or to have several users, turn on .htaccess for the site and use the familiar Apache directives AuthType Basic, AuthName, AuthUserFile and Require valid-user with an .htpasswd file. WardPane runs them itself, with its own limits against password guessing. See .htaccess.