Statamic Password Protect Laravel Package

Getting Started

• Install with composer require jorisnoo/statamic-password-protect; Statamic addons are typically auto-discovered.
• Check the package README first, then inspect the published config/service provider to confirm the middleware name and registration approach.
• Publish any config or views only if you need to customize the password form or protection behavior.
• Set the site password through the package’s config/env key rather than hard-coding it in source.
• First practical use case: gate a staging, pre-launch, or internal Statamic site behind a shared password without building custom auth.

Implementation Patterns

• Enable protection per environment: keep it on for staging/preview and off for local/test unless explicitly needed.
• Exclude operational routes such as health checks, webhooks, and asset endpoints so uptime checks and integrations are not blocked.
• Publish and override the password form view when the default UI does not match the project’s branding.
• Store the shared password in your secrets manager or hosting environment variables, then document rotation for the team.
• In automated tests, disable the middleware or configure a test-specific bypass rather than exercising the password form for every request.
• For client preview sites, combine the package with Statamic environment config so production remains public while previews stay password protected.

Gotchas and Tips

• Version 0.2.2 fixes post-verification behavior so users always redirect to the home page. If you need “return to originally requested URL” behavior, treat that as a customization rather than relying on the default.
• Middleware ordering matters: the protection middleware needs session support. If sessions are not started or the middleware is placed too early, password verification may not persist.
• Clear config cache after changing env values: php artisan config:clear and, in deployed environments, rebuild caches.
• Avoid committing the shared password. Use environment-specific secrets and rotate after contractor or client access changes.
• If the site behaves as if protection is disabled, verify the middleware is actually registered, the environment flag is correct, and route exclusions are not too broad.
• For custom redirects or deep-link preservation, inspect the package’s verification controller/middleware and override the redirect target deliberately.
• Keep the package constraint current; this is an early 0.x release, so review changelogs for behavior changes before upgrading across minor versions.