Fixed an error on the password prompt when the Invalid Login Window Duration setting was empty or invalid. It now falls back to the default of one hour.
3.0.16 2026-10-28
Added
Added the enableStaticCaching and staticCacheCookieName settings, which allow the password prompt and protected pages to be statically cached (e.g. by Craft Cloud), using an access cookie that’s included in the cache keys. (#86(opens new window))
Fixed
Fixed protected pages missing no-cache headers after successful access when static caching is disabled.
3.0.15 2026-10-22
Changed
Updated the minimum required Craft version to 5.9.12.
Updated the frontend build toolchain to Vite 8.3.4.
Fixed
Fixed a high-severity access control vulnerability.
Fixed a medium-severity access control vulnerability affecting protected URL rules.
Fixed a medium-severity access control vulnerability affecting URL aliases.
Fixed a low-severity access control vulnerability affecting regular-expression URL rules.
3.0.14 2026-10-15
Changed
Updated Craft API usage to avoid deprecated calls.
3.0.13 2026-10-07
Changed
Require Verbb Base 3.0.20 or later so shared control-panel layouts use the current asset bundle namespace. (verbb-base#3(opens new window))
3.0.12 2026-10-05
Changed
Updated the required version of verbb/base to 3.0.19.
Replaced the CodeKit stylesheet build with Vite and moved web assets to src/web.
Fixed
Fixed a high-severity access control vulnerability.
Fixed a medium-severity cross-site request forgery vulnerability affecting password-gate lockouts.
Fixed a medium-severity access control vulnerability affecting regular-expression URL rules.
Fixed a medium-severity open redirect vulnerability.
Fixed a medium-severity access control vulnerability affecting protected URL matching.
Fixed a medium-severity access control vulnerability affecting access cookies.
Fixed a low-severity access control vulnerability.
Fixed a low-severity access control vulnerability affecting denied IP addresses with access cookies.
Fixed a low-severity access control vulnerability affecting zero-prefix CIDR rules.
Fixed a low-severity sensitive data storage vulnerability.
Fixed a low-severity resource exhaustion vulnerability affecting invalid-login records.
3.0.11 2026-09-30
Changed
Route plugin settings through the plugin’s authorized settings controller.
Fixed
Fixed a high-severity access control vulnerability.
3.0.10 2026-09-23
Fixed
Fix saving one settings page resetting settings on the other pages. (#84).
3.0.9 2026-09-14
Changed
Updated documentation for clearer, more consistent guidance.
3.0.8 2026-09-13
Changed
Normalize plugin settings.
3.0.7 2026-08-29
Added
Add cookieDuration setting to control how long a visitor stays logged in for before being asked for the password again. Previously hard-coded to one hour.
Fixed
Fix enabled callback functions in config files no longer working after environment variable support was added in 3.0.6. (#83).
3.0.6 2026-06-05
Added
Add support for environment variables in password and enabled settings, including Control Panel autosuggestions.
Fixed
Fix password comparison timing vulnerability.
3.0.5 2025-11-29
Changed
Ensure rendering templates set a no-cache header for Craft Cloud.
3.0.3 2025-05-01
Fixed
Fix normalization of multi-line settings like URLs and IPs.
3.0.2 2025-02-05
Fixed
Fix layout in Craft 5.6 and match new front-end login theme.
3.0.1 2024-07-21
Added
Allow enabled to be set using a callback function in config files.
Changed
Update English translations.
Fixed
Fix multi-site protected/unprotected URLs not being honoured.
Fix an error when trying to determine multi-site plugin settings for installs where no primary site exists yet.