Security

Password-protect a site with one shared password.

Security scanner and monitor to keep your site and CMS secure.

Encode and hide emails from spam bots and web scrapers.

Integrate Google’s reCAPTCHA (v2) into your forms.

Integrate reCAPTCHA v3 validation into your forms.

Maintenance mode and smart HTTPS routing.

Purge Cloudflare caches from Craft.

SAML SSO Service Provider

Provides information about the Craft installation via an API

Automatically validates forms and prevents spam bots from submitting to your site.

Uses reCAPTCHA v3 to guess whether the user is a human or robot.

Content Security Policy manager for Craft CMS

Select one or more user groups.

Pulse — health, security and file-integrity monitoring for Craft CMS 5. Checks Craft core, plugins, server and PHP configuration, SSL certificates and security headers, and verifies core and plugin files against their official releases, from a single dashboard.

Password protect any page or entry.

Easily integrate Turnstile to validate your forms

Provide secure digital download links to your files.

Return an AWS signed URL and proxy the download request.

Sign users in with URL keys, trusted IPs or HTTP Basic Authentication.

Protect and track downloads. Prevent leech attempts.

Incrementally enforced new and secure passwords.

Integrate the Oh Dear monitoring service into Craft CMS.

Integrate hCAPTCHA validation into your forms.

A comprehensive monitoring plugin for Craft CMS that provides real-time insights into your website's health, performance, and security with uptime monitoring, SSL certificate validation, broken link detection, Lighthouse performance scores, and domain health checks.

Adds functionality to the Contact Form plugin

Content Security Policy (or CSP) generator using nonces.

Restrict what IP addresses can access the Craft control panel and front-end

URL-safe encryption and masking.

Backup securely to the cloud: S3, Dropbox, Google Drive, and more.

Deploy-safe control panel lockouts for Craft CMS, with bypass permissions and a custom lock screen.

Email notifications for user registration and activation.

Replace private data with dummy content

HTTP Basic Authentication within templates.

Purge Sucuri caches from Craft.

Create AWS Cloudfront Signed URLs for your assets

Cloudflare Access integration for Craft CMS.

Record HTTP requests to Craft

View, search, filter, and download server logs from the Craft CMS control panel.

Serve password protected files

OOPSpam Anti-Spam for Craft CMS

IP address blocker for Craft CMS applications to bock traffic from malicious sources.

captcha.eu for craftcms

Audit log for user activity in Craft: login, logout, failed logins and custom events with device, browser, IP, client-type and group metadata.

Screen public submissions and registrations for spam with Akismet.

CleanTalk Anti-Spam for Craft CMS

Prevents brute force password attacks on the Craft CMS control panel by tracking failed login attempts per IP address and blocking access after a configurable threshold.

Obfuscate an email or other strings to prevent spam-bots from sniffing it.

A Craft CMS plugin to configure HTTP Basic Authentication for your site.

Store and manage secrets in an encrypted file.

SAML Identity Provider

Reports operational metadata from a Craft CMS installation to a Manager for Craft platform over signed, outbound-only requests.

Password-protection for individual entries.

Very sweet honey for the robots. Simple ingredients.

Content safety and integrity plugin for Craft CMS. Prevents accidental breakage of content, relationships, assets, and site structure.

Comprehensive security suite for Craft CMS — scanning, active protection, audit logging, and notifications.

Prevent DDoS attacks from bots and keep your Craft protected.

Plain text field type for Craft that encrypts and encodes data when saved to the database.

Friendly Captcha v1 and v2 integration for CraftCMS

Seamless legacy user authentication for Craft CMS

Cloudflare Turnstile for Craft CMS — frictionless spam protection with automatic Contact Form integration.

A honeypot for bad bots — a hidden trap link that robots.txt tells crawlers to stay away from, and a permanent block for the ones that follow it anyway.

Enterprise-grade audit trail and compliance logging for Craft CMS

Cookie consent for Craft CMS: nothing third-party loads before the visitor agrees, and the HTML stays cacheable.

Terms of service and privacy policies for Craft CMS — generated from a questionnaire, kept current as the law moves, and wired into your site with footer links, update notices, cookie consent and agreement checkboxes.

CSP violation reporting and dashboard for Craft CMS 5.

All-in-one security toolkit for Craft CMS with security scanning, IP restrictions, CSP, SSL/domain monitoring, bot defence, and dependency audits.

Integrate Altcha's privacy-first spam protection into your Craft CMS forms.

Off-site database backups for Craft you can actually restore — integrity-verified, monitored, and recoverable from the bucket alone.

Validate user passwords against the Pwned Passwords API

Gated digital downloads and software licensing for Craft CMS — expiring links, download limits, versioned files, license keys with activation limits, a customer portal, refund revocation and EU VAT invoicing.

TrustCaptcha for CraftCMS — GDPR-compliant, privacy-first CAPTCHA

Send users an email alert when someone signs into their account

Compresses and encrypts every database backup Craft produces, making it several times smaller, and reverses both transparently when one is restored.

SAML 2.0 and OIDC single sign-on for the Craft CMS control panel: group mapping, JIT provisioning and a diagnostics panel.

Provide custom MFA for craft entry, category, assets and so on..

A simple plugin that provides Age Verification for your Site.

Enable authentication to Craft using AWS Cognito

Element-level authorization for Craft CMS with query-level access control.

Watches Craft CMS's queue jobs and console commands, and alerts you when a run is missed, fails, gets stuck or runs slow.

Passwordless, time-limited share links for private Craft assets. Video plays in the browser. Recipients never log in.

A minimal Craft plugin to provide Google OAuth login