Title: ncdLabs Site Access Policies Author: ncdlou Published: July 28, 2026 Last modified: July 28, 2026 --- Search plugins ![](https://ps.w.org/ncdlabs-site-access-policies/assets/banner-772x250.png?rev= 3625418) ![](https://ps.w.org/ncdlabs-site-access-policies/assets/icon-256x256.png?rev=3625418) # ncdLabs Site Access Policies By [ncdlou](https://profiles.wordpress.org/ncdlou/) [Download](https://downloads.wordpress.org/plugin/ncdlabs-site-access-policies.1.0.2.zip) * [Details](https://wordpress.org/plugins/ncdlabs-site-access-policies/#description) * [Reviews](https://wordpress.org/plugins/ncdlabs-site-access-policies/#reviews) * [Installation](https://wordpress.org/plugins/ncdlabs-site-access-policies/#installation) * [Development](https://wordpress.org/plugins/ncdlabs-site-access-policies/#developers) [Support](https://wordpress.org/support/plugin/ncdlabs-site-access-policies/) ## Description ncdLabs Site Access Policies is a policy-based access layer for WordPress. Protect entire sites, hostnames, and URL paths with passwords, passkeys, and WordPress users— without server configuration. #### Included in Free * Unlimited policies with drag-and-drop ordering * Exact and wildcard hostname/path matching * Password, passkey, and WordPress login authentication * User, role, and capability authorization (boolean authz trees) * Secure sessions, audit log, simulator, analyzer, and recovery #### Optional Premium companion (sold separately) Advanced capabilities (access groups, custom appearance profiles, SSO/IdP, SCIM, agency multisite tools, and more) are provided by a **separate Premium plugin** you download from ncdLabs after purchase. The Free plugin never locks included code behind a license key. Product page: https://ncdlabs.com/ncdlabs-site-access-policies/ #### Privacy By default this plugin does **not** contact external servers. Optional integrations you configure yourself (identity providers, SIEM webhooks, cloud backups) send only the data required for that service. Password hashes and private keys are never transmitted to cloud backups. Full notice: https://ncdlabs.com/products/ncdlabs-site-access-policies/privacy/ ## Screenshots [⌊Security Dashboard — protection status, recommendations, and quick actions.⌉⌊Security Dashboard — protection status, recommendations, and quick actions.⌉[ Security Dashboard — protection status, recommendations, and quick actions. [⌊Policies — ordered first-match rules for site, hostname, and path protection.⌉⌊ Policies — ordered first-match rules for site, hostname, and path protection.⌉[ Policies — ordered first-match rules for site, hostname, and path protection. [⌊Policy Simulator — try sample requests through the live decision pipeline safely.⌉⌊ Policy Simulator — try sample requests through the live decision pipeline safely .⌉[ Policy Simulator — try sample requests through the live decision pipeline safely. ## Installation 1. Upload the plugin to `/wp-content/plugins/ncdlabs-site-access-policies` 2. Activate through the Plugins screen 3. Open Access Policies in WP Admin and create your first policy ## FAQ ### Does Free require a license key? No. Every feature shipped in the Free plugin works without payment. Premium is a separate download. ### Where is the source for the admin JavaScript? Unminified sources live in `resources/js/`. Build with `npm install && npm run build`. Development repository: https://git.ncdlabs.com/ncdlabs/ncdlabs-site-access-policies ### Is this plugin GPLv2 compatible? Yes. The plugin is licensed GPLv2 or later. Bundled production libraries are GPL- compatible (MIT/BSD). Self-hosted IBM Plex fonts use the SIL Open Font License. ## Reviews There are no reviews for this plugin. ## Contributors & Developers “ncdLabs Site Access Policies” is open source software. The following people have contributed to this plugin. Contributors * [ ncdlou ](https://profiles.wordpress.org/ncdlou/) [Translate “ncdLabs Site Access Policies” into your language.](https://translate.wordpress.org/projects/wp-plugins/ncdlabs-site-access-policies) ### Interested in development? [Browse the code](https://plugins.trac.wordpress.org/browser/ncdlabs-site-access-policies/), check out the [SVN repository](https://plugins.svn.wordpress.org/ncdlabs-site-access-policies/), or subscribe to the [development log](https://plugins.trac.wordpress.org/log/ncdlabs-site-access-policies/) by [RSS](https://plugins.trac.wordpress.org/log/ncdlabs-site-access-policies/?limit=100&mode=stop_on_copy&format=rss). ## Changelog #### 1.0.2 * WordPress.org review follow-up: dbDelta via require_once + immediate call helper; no wholesale $_GET/$_SERVER/$_COOKIE assignment in request context factory * Removed RequestVars get/request helpers; recovery/email-verify use registered query_vars; admin screen detection via get_current_screen; AJAX allowlist uses heartbeat nonce / caps * Custom-table services/migrations declare justified DirectDatabaseQuery phpcs: disable (TableNames allowlist; prepared queries / %i) #### 1.0.1 * WordPress.org review remediations: dbDelta upgrade.php guard, prepared DDL migrations(% i), challenge assets enqueue static fallbacks (no inline CSS/JS) * Clarified read-only request adapters (RequestVars / RequestContextFactory); mutations remain REST + caps + wp_rest nonce #### 1.0.0 * Initial WordPress.org Free release with Premium companion model * Production Decision Engine pipeline (Conditions, Authentication, Authorization, Challenge) * Authorization uses boolean AuthzTree (legacy flat OR migrates on read/write) * Password vault: policies reference vault credentials via `password_id` (one password, many policies) * Policy Simulator and Evaluation Trace; Support Mode live-trace auto-expires after 1 hour * PePper contextual guidance; design-system admin SPA * Idempotent DB migrations; no required wipe on upgrade ## Meta * Version **1.0.2** * Last updated **5 hours ago** * Active installations **Fewer than 10** * WordPress version ** 6.8 or higher ** * Tested up to **7.0.2** * PHP version ** 8.3 or higher ** * Tags * [access-control](https://wordpress.org/plugins/tags/access-control/)[authentication](https://wordpress.org/plugins/tags/authentication/) [authorization](https://wordpress.org/plugins/tags/authorization/)[passkeys](https://wordpress.org/plugins/tags/passkeys/) [staging](https://wordpress.org/plugins/tags/staging/) * [Advanced View](https://wordpress.org/plugins/ncdlabs-site-access-policies/advanced/) ## Ratings No reviews have been submitted yet. [Your review](https://wordpress.org/support/plugin/ncdlabs-site-access-policies/reviews/#new-post) [See all reviews](https://wordpress.org/support/plugin/ncdlabs-site-access-policies/reviews/) ## Contributors * [ ncdlou ](https://profiles.wordpress.org/ncdlou/) ## Support Got something to say? Need help? [View support forum](https://wordpress.org/support/plugin/ncdlabs-site-access-policies/)