Security

Password-protect a site with one shared password.

Security scanner and monitor to keep your site and CMS secure.

Encode and hide emails from spam bots and web scrapers.

Integrate Google’s reCAPTCHA (v2) into your forms.

Maintenance mode and smart HTTPS routing.

Integrate reCAPTCHA v3 validation into your forms.

Purge Cloudflare caches from Craft.

SAML SSO Service Provider

Provides information about the Craft installation via an API

Automatically validates forms and prevents spam bots from submitting to your site.

Uses reCAPTCHA v3 to guess whether the user is a human or robot.

Select one or more user groups.

Content Security Policy manager for Craft CMS

Pulse — health, security and file-integrity monitoring for Craft CMS 5. Checks Craft core, plugins, server and PHP configuration, SSL certificates and security headers, and verifies core and plugin files against their official releases, from a single dashboard.

Password protect any page or entry.

Easily integrate Turnstile to validate your forms

Provide secure digital download links to your files.

Sign users in with URL keys, trusted IPs or HTTP Basic Authentication.

Protect and track downloads. Prevent leech attempts.

Integrate the Oh Dear monitoring service into Craft CMS.

Integrate hCAPTCHA validation into your forms.

Incrementally enforced new and secure passwords.

Return an AWS signed URL and proxy the download request.

A comprehensive monitoring plugin for Craft CMS that provides real-time insights into your website's health, performance, and security with uptime monitoring, SSL certificate validation, broken link detection, Lighthouse performance scores, and domain health checks.

Adds functionality to the Contact Form plugin

Content Security Policy (or CSP) generator using nonces.

Backup securely to the cloud: S3, Dropbox, Google Drive, and more.

Restrict what IP addresses can access the Craft control panel and front-end

URL-safe encryption and masking.

Deploy-safe control panel lockouts for Craft CMS, with bypass permissions and a custom lock screen.

Reports operational metadata from a Craft CMS installation to a Manager for Craft platform over signed, outbound-only requests.

Email notifications for user registration and activation.

Audit log for user activity in Craft: login, logout, failed logins and custom events with device, browser, IP, client-type and group metadata.

Replace private data with dummy content

HTTP Basic Authentication within templates.

Purge Sucuri caches from Craft.

Cloudflare Access integration for Craft CMS.

Integrate Altcha's privacy-first spam protection into your Craft CMS forms.

Create AWS Cloudfront Signed URLs for your assets

View, search, filter, and download server logs from the Craft CMS control panel.

OOPSpam Anti-Spam for Craft CMS

Record HTTP requests to Craft

Serve password protected files

captcha.eu for craftcms

IP address blocker for Craft CMS applications to bock traffic from malicious sources.

Screen public submissions and registrations for spam with Akismet.

Prevents brute force password attacks on the Craft CMS control panel by tracking failed login attempts per IP address and blocking access after a configurable threshold.

CleanTalk Anti-Spam for Craft CMS

Obfuscate an email or other strings to prevent spam-bots from sniffing it.

Store and manage secrets in an encrypted file.

SAML Identity Provider

A Craft CMS plugin to configure HTTP Basic Authentication for your site.

Password-protection for individual entries.

Plain text field type for Craft that encrypts and encodes data when saved to the database.

Friendly Captcha v1 and v2 integration for CraftCMS

Very sweet honey for the robots. Simple ingredients.

Prevent DDoS attacks from bots and keep your Craft protected.

Cloudflare Turnstile for Craft CMS — frictionless spam protection with automatic Contact Form integration.

Cookie consent for Craft CMS: nothing third-party loads before the visitor agrees, and the HTML stays cacheable.

Seamless legacy user authentication for Craft CMS

Content safety and integrity plugin for Craft CMS. Prevents accidental breakage of content, relationships, assets, and site structure.

Comprehensive security suite for Craft CMS — scanning, active protection, audit logging, and notifications.

A honeypot for bad bots — a hidden trap link that robots.txt tells crawlers to stay away from, and a permanent block for the ones that follow it anyway.

An audit log for Craft CMS: who changed what, when, from where and what it said before, plus every sign-in and change of access, in one log.

All-in-one security toolkit for Craft CMS with security scanning, IP restrictions, CSP, SSL/domain monitoring, bot defence, and dependency audits.

Terms of service and privacy policies for Craft CMS — generated from a questionnaire, kept current as the law moves, and wired into your site with footer links, update notices, cookie consent and agreement checkboxes.

Enterprise-grade audit trail and compliance logging for Craft CMS

CSP violation reporting and dashboard for Craft CMS 5.

The site's scheduled jobs, kept in the repository: one cron entry runs them all.

Provide custom MFA for craft entry, category, assets and so on..

Validate user passwords against the Pwned Passwords API

Off-site database backups for Craft you can actually restore — integrity-verified, monitored, and recoverable from the bucket alone.

Per-element user restrictions for Craft CMS — restrict an editor to individual entries, categories, assets and users instead of whole sections, by hand-picked assignment or by rules that follow authorship, structure branches, relations and element conditions.

Turns Craft's own security events into log lines fail2ban can ban on — failed logins, blocked usernames, bad tokens, 404 floods and WordPress probes — and writes the filter and jail files for you.

TrustCaptcha for CraftCMS — GDPR-compliant, privacy-first CAPTCHA

GDPR and DSAR governance for Craft CMS — subject access request intake, everything you hold on a person assembled across users, entries, orders, submissions, comments and logs, anonymise or erase, a consent and processing-activity ledger, and retention rules that purge on their own.

Send users an email alert when someone signs into their account

Gated digital downloads and software licensing for Craft CMS — expiring links, download limits, versioned files, license keys with activation limits, a customer portal, refund revocation and EU VAT invoicing.

SAML 2.0 and OIDC single sign-on for the Craft CMS control panel: group mapping, JIT provisioning and a diagnostics panel.

Compresses and encrypts every database backup Craft produces, making it several times smaller, and reverses both transparently when one is restored.

Cookie consent management for Craft CMS with configurable banners, preference controls, cookie blocking, consent logging, and privacy integrations.

Element-level authorization for Craft CMS with query-level access control.

Legal texts for Craft CMS — imprint, privacy policy, cookies and terms, generated from the facts about your site and kept current as the law moves.

A simple plugin that provides Age Verification for your Site.

Enable authentication to Craft using AWS Cognito

Passwordless, time-limited share links for private Craft assets. Video plays in the browser. Recipients never log in.

Watches Craft CMS's queue jobs and console commands, and alerts you when a run is missed, fails, gets stuck or runs slow.

A minimal Craft plugin to provide Google OAuth login

Stops fake, mistyped and throwaway email addresses in Craft user registration and contact forms. Runs on your own server, no API key.