Is there a way to avoid anonymous users can see nodes of a content type, like a block or a view?

I can control the access with a view, but if I know the link for a node, I can see it without first logging in.

4 Answers 4


You can control the access to nodes in the hook hook_node_access():


use Drupal\node\NodeInterface;
use Drupal\Core\Session\AccountInterface;
use Drupal\Core\Access\AccessResult;

function mymodule_node_access(NodeInterface $node, $op, AccountInterface $account) {
  if ($account->isAnonymous() && $node->gettype() == 'article') {
    return AccessResult::forbidden()->cachePerPermissions();
  return AccessResult::neutral()->cachePerPermissions();

This controls the direct access to the node, not the access in views. But this is what you probably want.

  • I believe that to control access in view as well, you would use hook_node_grants.
    – Jonathan
    Jan 18, 2018 at 19:40

Your best bet is to use Rabbit Hole, or Content Access when it has an updated release.

Rabbit Hole

Rabbit Hole is a module that adds the ability to control what should happen when an entity is being viewed at its own page. Perhaps you have a content type that never should be displayed on its own page, like an image content type that's displayed in a carousel. Rabbit Hole can prevent this node from being accessible on its own page, through node/xxx.

Content Access

This module allows you to manage permissions for content types by role and author. It allows you to specifiy custom view, edit and delete permissions for each content type. Optionally you can enable per content access settings, so you can customize the access for each content node.

Note that what I believe you want is to block all access to a node of a content type - and only Content Access will fulfill that over Rabbit Hole.

Beyond that, I think you'd be looking at implementing your own access control if neither of these suit.

  • Sorry to quesdtion your answer Kevin, but are you familiar with the Group module? Have a look at the video tutorial to understand what I mean ... BTW: for D7 I also used to recommend "Content Access". Mar 15, 2017 at 19:10
  • 2
    Not since it was OG. Kinda heavy to install unless there's a need in that sense?
    – Kevin
    Mar 15, 2017 at 20:25
  • "... since it was OG"? What do you mean by that? And about "heavy": do you OG (if so I agree) or Group (if so I disagree)? Mar 15, 2017 at 20:44
  • I always just thought Group was a fork of OG for D8
    – Kevin
    Mar 15, 2017 at 20:44
  • Sorry (again) Kevin, that is not the case ... read more. Mar 15, 2017 at 20:49

You can use the Node View Permissions module.

Enable it and then you can assign what roles that can view what content types under path 'admin/people/permissions' under section 'Node view permissions'


Maybe you want to give it a try to use the Group module, which allows for creating arbitrary collections of your content and users on your site, and grant access control permissions on those collections. It is available as of D7, and has a D8 version also. It creates groups as entities, making them fully fieldable, extensible and exportable. Every group can have users, roles and permissions attached to it (refer to "What are the various roles supported by the Group module?" for more details about that).

For this specific question, you'd enable the gnode submodule, and for each group type you would define the appropriate permissions (view, edit, delete, etc) for the various Content Types.

It seems that you would want to grant access to what, in Group, is called "Members" and "Outsiders" (= logged in users who are not a member of a group). But you woudn't allow access to "Anonymous" (site visitors that are not logged it).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.