I'm using the Protected Pages module to make an area of the website - which is about 13 pages - password protected. The problem is that users have to enter the password to view every page rather than being able to enter the password once and then being able to see the entire section of the website (the members portal).

I had only one thing in the list of password protected pages which was /members which is part of the url. Every page that is supposed to be password protected has a url of website.com/members/pageName but that didn't work because anyone could just put the url straight into the browser and the page would should up without having to enter the password.

So, i added all 13 pages to the list of password protected pages but now users have to enter the password on every page.

We have two menus on the site. The public menu and members menu. When a user logs in to the members portal the menu changes and when you select a page from the menu, you have to enter the password every time, but we want it so users only have to enter the password once and they can see all the pages in the members portal.

How do I set that up?


Protected pages is really intended for one off password protection of webpages on a site. In order to have users login once to access a section of content, you should setup a user role assigned to a specific content type.

In the case where your existing content requiring authentication is the same content type as the non authenticated content, you can use the TAC Lite (taxonomy access control lite) module. To restructure the existing site to use this:

  1. Create a new taxonomy to distinguish the password protected nodes from the others
  2. Assign your custom term to the nodes to distinguish that they need authentication to view.
  3. Install TAC Lite module.
  4. Setup a new user role to associate with viewing permissions for the nodes with the assigned term.
  5. Configure TAC Lite for the node type with term and user role.
  6. Remove protected pages passwords for the given pages.
  7. Clear caches
  8. Test accessing (without login, you should see permission denied messaging)
  9. Optionally, install r4032login module to automatically direct nonauthenticated users trying to access this section to the login page, and subsequently redirect back to requested url.

For future site builds or enhancements, I would recommend just setting up a distinct authenticated only content type and installing r4032login.

  • Woops. I knew I was forgetting something in my question. It's a Drupal8 site. – Samuel Oct 17 '19 at 2:52
  • TAC lite is also available for D8. I haven't used it in a D8 site, but suspect steps and config are similar. – Anson W Han Oct 17 '19 at 2:54
  • But how do I set this up with a password so users can view the pages? – Samuel Oct 17 '19 at 3:03
  • Once you create a user role, setup a generic user account that they would use to login with – Anson W Han Oct 17 '19 at 3:46
  • 1
    @Samuel No, I don't think Anson meant that. An administrator user account should not be shared between different users. – kiamlaluno Oct 17 '19 at 6:41

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.