Description
ncdLabs Site Access Policies is a policy-based access layer for WordPress. Protect entire sites, hostnames, and URL paths with passwords, passkeys, and WordPress users — without server configuration.
Included in Free
- Unlimited policies with drag-and-drop ordering
- Exact and wildcard hostname/path matching
- Password, passkey, and WordPress login authentication
- User, role, and capability authorization (boolean authz trees)
- Secure sessions, audit log, simulator, analyzer, and recovery
Optional Premium companion (sold separately)
Advanced capabilities (access groups, custom appearance profiles, SSO/IdP, SCIM, agency multisite tools, and more) are provided by a separate Premium plugin you download from ncdLabs after purchase. The Free plugin never locks included code behind a license key.
Product page: https://ncdlabs.com/ncdlabs-site-access-policies/
Privacy
By default this plugin does not contact external servers. Optional integrations you configure yourself (identity providers, SIEM webhooks, cloud backups) send only the data required for that service. Password hashes and private keys are never transmitted to cloud backups.
Full notice: https://ncdlabs.com/products/ncdlabs-site-access-policies/privacy/
Screenshots
Installation
- Upload the plugin to
/wp-content/plugins/ncdlabs-site-access-policies - Activate through the Plugins screen
- Open Access Policies in WP Admin and create your first policy
FAQ
-
Does Free require a license key?
-
No. Every feature shipped in the Free plugin works without payment. Premium is a separate download.
-
Where is the source for the admin JavaScript?
-
Unminified sources live in
resources/js/. Build withnpm install && npm run build. Development repository: https://git.ncdlabs.com/ncdlabs/ncdlabs-site-access-policies -
Is this plugin GPLv2 compatible?
-
Yes. The plugin is licensed GPLv2 or later. Bundled production libraries are GPL-compatible (MIT/BSD). Self-hosted IBM Plex fonts use the SIL Open Font License.
Reviews
There are no reviews for this plugin.
Contributors & Developers
“ncdLabs Site Access Policies” is open source software. The following people have contributed to this plugin.
Contributors
Translate “ncdLabs Site Access Policies” into your language.
Interested in development?
Browse the code, check out the SVN repository, or subscribe to the development log by RSS.
Changelog
1.0.2
- WordPress.org review follow-up: dbDelta via require_once + immediate call helper; no wholesale $_GET/$_SERVER/$_COOKIE assignment in request context factory
- Removed RequestVars get/request helpers; recovery/email-verify use registered query_vars; admin screen detection via get_current_screen; AJAX allowlist uses heartbeat nonce / caps
- Custom-table services/migrations declare justified DirectDatabaseQuery phpcs:disable (TableNames allowlist; prepared queries / %i)
1.0.1
- WordPress.org review remediations: dbDelta upgrade.php guard, prepared DDL migrations (%i), challenge assets enqueue static fallbacks (no inline CSS/JS)
- Clarified read-only request adapters (RequestVars / RequestContextFactory); mutations remain REST + caps + wp_rest nonce
1.0.0
- Initial WordPress.org Free release with Premium companion model
- Production Decision Engine pipeline (Conditions, Authentication, Authorization, Challenge)
- Authorization uses boolean AuthzTree (legacy flat OR migrates on read/write)
- Password vault: policies reference vault credentials via
password_id(one password, many policies) - Policy Simulator and Evaluation Trace; Support Mode live-trace auto-expires after 1 hour
- PePper contextual guidance; design-system admin SPA
- Idempotent DB migrations; no required wipe on upgrade