Knock First – Password Protect Your Site

开发者	stettzy
更新时间	2026年10月17日 02:54
PHP版本:	7.4 及以上
WordPress版本:	7.1
版权:	GPLv2 or later
版权网址:	版权信息

下载

1.0.2

详情介绍:

Knock First makes it easy to password protect an entire WordPress website with one shared password. It is ideal for private sites, staging websites, client previews, coming-soon pages, and launches. The plugin is disabled by default. After activation, open Settings > Site Password, choose a password, and enable protection. Features:

One switch protects the public-facing site.
Passwords are stored as one-way WordPress password hashes, never as plain text.
Access uses a signed, HTTP-only browser cookie that is invalidated when the password changes.
Choose an access duration from one hour to 30 days.
Optionally let logged-in WordPress users bypass the gate.
Administrators and the standard WordPress login always remain accessible.
Public REST API requests are protected, core XML sitemaps are disabled, and robots are asked not to index the protected site.
The unlock screen is responsive, keyboard friendly, and uses no external services or assets.
No tracking, advertising, remote requests, or user accounts.

Important security note This plugin is a simple privacy gate. It is not a replacement for WordPress user accounts, server-level access control, or another security system when protecting sensitive or regulated data. Public files already uploaded to the Media Library may remain reachable by their direct URLs, and another plugin can expose data through its own custom endpoints.

安装:

Install and activate Knock First.
Go to Settings > Site Password.
Enter a shared password.
Select Require the site password and save your changes.
Open the site in a private browser window to test the unlock screen.

Protection is off immediately after activation, so activating the plugin cannot unexpectedly lock visitors out.

升级注意事项:

1.0.2 Updates the plugin name and publication slug to the distinctive Knock First identity.

常见问题:

Can I still sign in to WordPress?

Yes. The standard WordPress login and administration screens remain available. Administrators always bypass the gate.

Is the password stored in plain text?

No. Knock First uses the WordPress password hashing API. The original password cannot be retrieved from the saved setting.

What happens when I change the password?

All existing Knock First access cookies become invalid immediately. Visitors must enter the new password.

Does this hide media files?

Not when someone already knows a file's direct URL. WordPress usually serves uploaded files directly through the web server, before plugins run. Use server-level protection or private object storage when the files themselves are sensitive.

Does this stop search engines?

While protection is enabled, the unlock page sends no-index directives, the virtual robots.txt disallows crawling, and WordPress core sitemaps are disabled. Search engines control their own behavior, and previously indexed URLs can take time to disappear.

Will it work with page caching?

The plugin sends no-cache headers and sets the standard DONOTCACHEPAGE constant while enabled. Some host-level or CDN caches run before WordPress and may need a manual exclusion or cache purge.

Does the plugin collect personal data?

No. It makes no remote requests and stores no visitor records. It sets one necessary HTTP-only cookie after a visitor enters the correct password.

更新日志: