InviteAccess — restrict staging site access with invite codes

[maximus]

Hey everyone!

I just released a new module called InviteAccess. It's something I built for my own workflow and figured it might be useful for others too.

The problem: when handing off a staging site to a client or a design agency, you either open it to the world or reach for HTTP Basic Auth — which works but isn't pretty and requires server config. I wanted something in between: a proper gate page that looks like it belongs to the project, with separate codes for each team.

What it does

InviteAccess hooks into ProcessPageView::execute (before any template rendering) and blocks all frontend requests until a valid invite code is entered. Logged-in ProcessWire users always pass through automatically.

You define codes in the module config, one per line:

SUMMER2025|Summer Campaign
AGENCY-PREVIEW|Agency Team
CLIENT-ACCESS|Client Preview

The label after the pipe shows up in the access log, so you can see exactly which team accessed the site and when.

Features

• Multiple invite codes with optional labels
• Session-based auth — enter once, stays valid for a configurable number of hours
• JSON access log with timestamp, IP, user agent, URL — last 50 entries shown right in the admin config panel
• Light / Dark / Auto theme switcher on the gate page (saved in localStorage, reacts to OS preference)
• Accent color setting — red, blue, green or black
• Configurable allowed pages that bypass the gate entirely
• CSRF protection, hash_equals() for timing-safe comparison, Cloudflare-aware IP detection

The gate page uses ApfelGrotezk font and a design inspired by processwire main page itself — warm gray background, white card, mobile-first.

Screenshots

Installation

cd site/modules
git clone https://github.com/mxmsmnv/InviteAccess.git

Then Modules → Refresh → Install → Configure.

GitHub: https://github.com/mxmsmnv/InviteAccess

Happy to hear any feedback or suggestions!