I am creating a new Drupal 7 based site.

The development will be on a server that is publicly accessible. I am working in a multi-site environment.

I would like to totally block access to the site to anyone & anything but authorized users. Including access to the site name, theme, etc...

I used Secure Site for similar tasks before. It did http-level authentication and returned 403 when authentication failed. It doesn't have a D7 version.

What would be the easiest way to do this?

5 Answers 5


Make a module and paste following code in your module file:


 * Implementation of hook_boot().
 * Ask for user credentials and try to authenticate.
function foo_boot() {
  require_once DRUPAL_ROOT . '/includes/password.inc';

  if (isset($_SERVER['PHP_AUTH_USER']) && isset($_SERVER['PHP_AUTH_PW'])) {
    $query = "SELECT pass FROM {users} WHERE name = :name";
    $result = db_query($query, array(':name' => $_SERVER['PHP_AUTH_USER']));
    $account = new stdClass();
    foreach ($result as $row) {
      $account->pass = $row->pass;
    if (isset($account->pass)) {
      if (user_check_password($_SERVER['PHP_AUTH_PW'], $account)) {

  header('WWW-Authenticate: Basic realm="Development"');
  header('HTTP/1.0 401 Unauthorized');

This uses HTTP Authentication and checks the Drupal Database for a valid username and password.

If you have any problems with PHP CLI, Drush or cron, you can add following code in the hook:

  // Allow cron through
  if (basename($_SERVER['PHP_SELF']) == 'cron.php') {

  // Allow PHP CLI/Drush through
  if (isset($_SERVER['argc'])) {
    if (php_sapi_name() == 'cli' || (is_numeric($_SERVER['argc']) && $_SERVER['argc'] > 0)) {
  • Word to the wise, this will completely screw your Drush environment. Extra upvotes from me if you create a Drush workaround. Commented Jun 19, 2013 at 13:00
  • Done, added a more broad approach that includes PHP CLI and cron.php.
    – Bart
    Commented Jun 19, 2013 at 13:31
  • 1
    Hot. Quick answer, too. I'd up-vote it again if I could. Commented Jun 19, 2013 at 13:39
  • this does not work at all with Drupal 8
    – DrCord
    Commented Jun 20, 2016 at 15:18
  • Hence why this is tagged as Drupal 7.
    – Bart
    Commented Jun 20, 2016 at 15:31

If you're using Drupal 7 the Shield module is available for this purpose. It authenticates a single, shared user and password.

PHP Authentication shield. It creates a simple shield for the site with Apache authentication. It hides the sites, if the user does not know a simple username/password. It handles Drupal as a "walled garden". This module helps you to protect your (dev) site with HTTP authentication.

  • +1 - Don't reinvent the wheel. This is already done and accounts for different server configurations and drush. Commented Dec 24, 2014 at 15:53

Add mod_auth to apache setup. This varies depending on your host (linux, windows). This may involve downloading a module, it may involve just uncommenting a line in your httpd.conf

 LoadModule auth_basic_module modules/mod_auth_basic.so

Create an .htpasswd file, using the htpasswd command in the apache binaries folder

 htpasswd -c user pass

Add the following code to your <DIRECTORY> statement right after your clean URLs rewrite rule:

AuthType Basic
AuthName "My Auth"
AuthUserFile \path\to\.htpasswd
Require valid-user

Restart apache. Profit.

  • Thanks. I cannot test this solution as I this project is in shared hosting and I don't have access to the httpd.conf. I wonder however if this can work at all in a multi-site environment.
    – daphshez
    Commented Aug 20, 2011 at 19:15
  • do you have access to the .htaccess file in drupal root? I'm not 100% sure, but you can try putting it in there. Mind you, Bart's solution seems a lot better :)
    – Alex C
    Commented Aug 22, 2011 at 11:16
  • see my reply to Dan. I can change the .htaccess, but I am not sure how it helps me in a multi-site configuration.
    – daphshez
    Commented Sep 9, 2011 at 6:18
  • Although this is good solution but you cannot test social sharing features with it. Commented Feb 22, 2017 at 7:50

Use HTTP authentication. How this is done with Apache is documented at http://httpd.apache.org/docs/2.2/howto/auth.html. For a multisite installation, the <Directory> section of the <VirtualHost> would be an appropriate place to put the configuration directives.


The OP has commented that this is on shared hosting. Most shared hosting provides cPanel or some other control panel, which will do simple .htaccess password protection for directories.

I have protected the top-level directory of a site under development using this method. If you use cPanel to protect the directory, look for the "Password Protect Directories" menu item.

If you protect the top-level directory before you install Drupal, cPanel will create a .htaccess file in that directory. Append or prepend the contents of that file with the .htaccess file that Drupal provides. If you protect the directory after installing Drupal, I am fairly sure cPanel will just add the lines it needs to the existing Drupal .htaccess file and not disturb the rest of the file. Just make sure you preserve those lines if you replace the .htaccess file during a Drupal upgrade.

  • Thanks, I actually have shell access too. But can I use htaccess (or httpd.conf, for that matter) when I want to protect only one site in a multi-site configuration?
    – daphshez
    Commented Sep 9, 2011 at 6:17
  • Sorry, I missed the multi-site comment in the OP. I don't use multi-site, but I looked up how it works. Since Drupal multi-site uses a single top-level dir, of the solutions here, I think only Bart's would work. Maybe you could also run the dev site in maintenance mode, to lock out everyone but the admin. See here for some hints. Commented Sep 13, 2011 at 15:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.