ncdLabs Site Access Policies

ncdLabs Site Access Policies is a policy-based access layer for WordPress. Protect entire sites, hostnames, and URL paths with passwords, passkeys, and WordPress users — without server configuration. Included in Free

• Unlimited policies with drag-and-drop ordering
• Exact and wildcard hostname/path matching
• Password, passkey, and WordPress login authentication
• User, role, and capability authorization (boolean authz trees)
• Secure sessions, audit log, simulator, analyzer, and recovery

Optional Premium companion (sold separately) Advanced capabilities (access groups, custom appearance profiles, SSO/IdP, SCIM, agency multisite tools, and more) are provided by a separate Premium plugin you download from ncdLabs after purchase. The Free plugin never locks included code behind a license key. Product page: https://ncdlabs.com/ncdlabs-site-access-policies/ Privacy By default this plugin does not contact external servers. Optional integrations you configure yourself (identity providers, SIEM webhooks, cloud backups) send only the data required for that service. Password hashes and private keys are never transmitted to cloud backups. Full notice: https://ncdlabs.com/products/ncdlabs-site-access-policies/privacy/

1.0.2

• WordPress.org review follow-up: dbDelta via require_once + immediate call helper; no wholesale $_GET/$_SERVER/$_COOKIE assignment in request context factory
• Removed RequestVars get/request helpers; recovery/email-verify use registered query_vars; admin screen detection via get_current_screen; AJAX allowlist uses heartbeat nonce / caps
• Custom-table services/migrations declare justified DirectDatabaseQuery phpcs:disable (TableNames allowlist; prepared queries / %i)

1.0.1

• WordPress.org review remediations: dbDelta upgrade.php guard, prepared DDL migrations (%i), challenge assets enqueue static fallbacks (no inline CSS/JS)
• Clarified read-only request adapters (RequestVars / RequestContextFactory); mutations remain REST + caps + wp_rest nonce

1.0.0

• Initial WordPress.org Free release with Premium companion model
• Production Decision Engine pipeline (Conditions, Authentication, Authorization, Challenge)
• Authorization uses boolean AuthzTree (legacy flat OR migrates on read/write)
• Password vault: policies reference vault credentials via password_id (one password, many policies)
• Policy Simulator and Evaluation Trace; Support Mode live-trace auto-expires after 1 hour
• PePper contextual guidance; design-system admin SPA
• Idempotent DB migrations; no required wipe on upgrade