توضیحات

ncdLabs Site Access Policies is a policy-based access layer for WordPress. Protect entire sites, domain names, and URL paths with passwords, passkeys, and WordPress users — without server configuration.

Included in Free

Unlimited policies with drag-and-drop ordering
Exact and wildcard domain name/path matching
Password, passkey, and WordPress login authentication
User, role, and capability authorization (boolean authz trees)
Secure sessions, audit log, simulator, analyzer, and recovery

Optional Premium companion (sold separately)

Advanced capabilities (access groups, custom appearance profiles, SSO/IdP, SCIM, agency multisite tools, and more) are provided by a separate Premium plugin you download from ncdLabs after purchase. The Free plugin never locks included code behind a license key.

Product page: https://ncdlabs.com/ncdlabs-site-access-policies/

Privacy

By default this plugin does not contact external servers. Language packs are handled by WordPress’s normal translation updates — this plugin does not call WordPress.org on activation. Optional integrations you configure yourself (identity providers, SIEM webhooks, cloud backups) send only the data required for that service. Password hashes and private keys are never transmitted to cloud backups.

WordPress Tools Export / Erase Personal Data includes plugin records linked to the requested user (sessions, passkeys, authorized-user links, access-group memberships, and audit events). Audit events are anonymized rather than deleted so security retention remains intact. Shared policies and vault credentials belonging to other users are never erased.

Full notice: https://ncdlabs.com/products/ncdlabs-site-access-policies/privacy/

عکس‌های صفحه

Security Dashboard — protection status, recommendations, and quick actions.

Policies — ordered first-match rules for site, domain name, and path protection. — Security Dashboard — protection status, recommendations, and quick actions.

نصب

Upload the plugin to /wp-content/plugins/ncdlabs-site-access-policies
Activate through the Plugins screen
Open Access Policies in WP Admin and create your first policy

سوالات متداول

Does Free require a license key?: No. Every feature shipped in the Free plugin works without payment. Premium is a separate download.
Where is the source for the admin JavaScript?: Unminified sources live in resources/js/. Build with npm install && npm run build. Development repository: https://git.ncdlabs.com/ncdlabs/ncdlabs-site-access-policies
Is this plugin GPLv2 compatible?: Yes. The plugin is licensed GPLv2 or later. Bundled production libraries are GPL-compatible (MIT/BSD). Self-hosted IBM Plex fonts use the SIL Open Font License.

نقد و بررسی‌ها

نقد و بررسی‌ای برای این افزونه یافت نشد.

توسعه دهندگان و همکاران

“ncdLabs Site Access Policies” نرم افزار متن باز است. افراد زیر در این افزونه مشارکت کرده‌اند.

someguynamedlou

ترجمه “ncdLabs Site Access Policies” به زبان شما.

علاقه‌ مند به توسعه هستید؟

کد را مرور کنید، مخزن SVN را بررسی کنید، یا از طریق RSS در گزارش توسعه مشترک شوید.

گزارش تغییرات

1.0.5

Security: fail closed on configuration errors without a presentation policy; Premium entitlement defaults fail closed (explicit SKU); truthful cloud backup results.
Fix: auth_mode=all shared completion for WordPress login, password, passkey, IdP, and verified email.
Fix: genuine privacy export/erase; remove plugin-initiated language-pack downloads.
Feature: persist and evaluate scheduled policy starts_at/ends_at (UTC) with admin UI.

1.0.4

WordPress-login-only challenges redirect to wp-login.php (with safe return URL) instead of the HTML challenge page
Policies whose authorization needs a WordPress user automatically include wordpress_login among auth methods
More reliable wp-login.php exemption detection via is_login() / script name (not only REQUEST_URI basename)

1.0.3

Scope UI uses “domain name” wording (exact/wildcard/domain name and path) instead of hostname
Domain / Path Protection setup recipe naming and description
Public challenge password field layout overflow fix
Hardened enforcement exemptions (exact wp-login.php / wp-admin path matching)
Multisite network actions require network admin; safer email-domain JIT roles and IdP outbound URL checks

1.0.2

WordPress.org review follow-up: dbDelta via require_once + immediate call helper; no wholesale $_GET/$_SERVER/$_COOKIE assignment in request context factory
Removed RequestVars get/request helpers; recovery/email-verify use registered query_vars; admin screen detection via get_current_screen; AJAX allowlist uses heartbeat nonce / caps
Custom-table services/migrations declare justified DirectDatabaseQuery phpcs:disable (TableNames allowlist; prepared queries / %i)

1.0.1

WordPress.org review remediations: dbDelta upgrade.php guard, prepared DDL migrations (%i), challenge assets enqueue static fallbacks (no inline CSS/JS)
Clarified read-only request adapters (RequestVars / RequestContextFactory); mutations remain REST + caps + wp_rest nonce

1.0.0

Initial WordPress.org Free release with Premium companion model
Production Decision Engine pipeline (Conditions, Authentication, Authorization, Challenge)
Authorization uses boolean AuthzTree (legacy flat OR migrates on read/write)
Password vault: policies reference vault credentials via password_id (one password, many policies)
Policy Simulator and Evaluation Trace; Support Mode live-trace auto-expires after 1 hour
PePper contextual guidance; design-system admin SPA
Idempotent DB migrations; no required wipe on upgrade