I use Page Safe in my current Classic sites to create members only pages…they just enter a 4 digit code to get in…will there be a way to do this in elements as a standard component?
Hi @Godber Here is a Chaptgpt answer to your question :
Creating a Component for Page Access Restriction: Security Concerns and the Benefits of PHP
When designing a website, you may need to restrict access to specific pages, such as requiring users to enter a code before viewing certain content. With Realmac Elements, you can build a component that prompts for a code, but there are important security limitations if this is implemented solely on the client side. Here’s how to create this component, the security risks involved, and why a PHP-based solution offers a more secure alternative.
Building the Basic Access Code Component
In Realmac Elements, you can create a simple access code component that displays a form for users to enter a code. Here’s an example of how this can be structured:
- HTML Template: Use a form for entering the access code.
- JavaScript: Write a script to verify the code and display the content if correct. Optionally, you can store the result in localStorage so the user does not need to re-enter the code on other pages.
Example HTML and JavaScript:
Enter Access Code: AccessWelcome! You now have access to the content.
Security Concerns with Client-Side Code
This method relies on client-side JavaScript and localStorage, which are insecure for several reasons:
- Code Manipulation: Since the code is executed on the client (user’s browser), users can easily inspect or modify it to bypass the access restriction. This could include directly manipulating the localStorage or editing the JavaScript in the browser console to reveal protected content.
- No Real Authentication: With localStorage, there’s no way to verify if the user’s session is valid, which means that anyone with a basic understanding of developer tools could circumvent the access code.
- Limited Session Control: The lack of server-side control means you cannot manage session expiration, limit retries, or implement more robust security mechanisms.
Because of these security issues, relying solely on client-side code is not recommended for sensitive access restrictions. A better solution is to handle the code verification on the server side.
Using PHP for Secure Server-Side Verification
To securely implement an access restriction, server-side verification with PHP is a robust solution. Here’s how it works:
- Form Submission to PHP: When a user submits the access code, the form sends the data to a PHP script, which verifies if the code is correct.
- Session Management: If the code is valid, PHP creates a session for the user, allowing access to protected pages only for that session. PHP sessions are managed on the server, meaning users cannot manipulate them from the client side.
- Redirection for Unauthorized Access: PHP can redirect users who attempt to access protected pages without a valid session to an error or login page.
Here is an example of a PHP-based solution:
Enter Access Code: Access
- HTML Form
<?php session_start(); $expected_code = "12345"; // Replace with your actual code if ($_SERVER["REQUEST_METHOD"] === "POST") { $code = $_POST["access-code"]; if ($code === $expected_code) { $_SESSION["access_granted"] = true; header("Location: restricted_content.php"); // Redirect to protected content exit(); } else { echo "Incorrect code"; } } ?>
- PHP Script for Verification (verify_code.php)
<?php session_start(); if (!isset($_SESSION["access_granted"]) || $_SESSION["access_granted"] !== true) { header("Location: access_denied.php"); exit(); } ?> Protected Content
- PHP Protected Content (restricted_content.php)
Welcome! You have access to the protected content.
Benefits of PHP and Necessary Knowledge
Using PHP for access control provides a much higher level of security, but it does require some additional technical knowledge:
- Understanding of PHP Sessions: PHP sessions are stored on the server and offer more control over user access and session expiration. Developers should be familiar with how sessions work and how to configure them securely.
- Knowledge of HTTP Methods and Headers: Properly managing form submissions with the POST method and handling redirects securely are essential. This knowledge is important to prevent unauthorized access and ensure smooth navigation.
- Server Configuration: PHP access control requires a server capable of handling PHP scripts, which means additional configuration might be needed, especially for redirections and session management.
Conclusion
While creating a simple access code component with JavaScript may seem easy, it lacks robust security and can be easily bypassed. A server-side solution using PHP offers a more secure approach by verifying access codes and managing user sessions, but it requires a good understanding of PHP, sessions, and server configuration to be implemented correctly. For any sensitive content, a PHP-based solution is strongly recommended to protect the integrity of the website.
My personal conclusion is that IA use creates a security concern which will increase exponentially.
Vibralogix provides Sitelok which is really powerful and secure.
I refer back to my original question…will there be a way to do this in elements as a standard component?
If you mean this will be possible with the standard components provided, I don’t think that will be the case. Just as it wasn’t possible by default in Classic. I think you’ll need to design a custom component yourself or wait for a developer to do it, but they’ll likely charge for it (just like with the hundreds of stacks currently available to extend Classic’s functionality)
1 Like
The functionality that Page Safe provides shouldn’t be too hard to reproduce as a custom component. It’s basic enough and doesn’t have too many moving parts.
@vibralogix’s Sitelok is a lot more advanced and has lots of other nice features. I’m actually hoping they bring it over to Elements. It would be fantastic for users to be able to build fully fledged membership sites in Elements.
This won’t be built into Elements, so it’ll have to come from a third-party or by using a custom component.
It’s early days for Elements and I’m sure once it officially launches, we’ll start to see more solutions being built and developed to fill these gaps.
1 Like
Hi @dang
I have already installed and tested Sitelok with Elements, it works very well, just copy-paste the code snippets in the right place, it’s as simple as with RW classic and Vibralogix documentation. 
1 Like
and how much does sitelok cost??? the point of using elements was to not use 3rd party stuff…thats why I asked if it would be a component!!!
That’s good to know! I was thinking they had a suite of stacks instead of snippets, but now that I’m thinking harder about it, I think another developer created the stacks for Sitelok. Joe if I recall correctly.
Oh well, he could bring them over to Elements too if he wanted. 
Sitelok is more advanced than what you are using (Page Safe).
If you are using Page Safe and you are satisfied with it, no need to change to Sitelok. I imagine someone would/could create a custom component that offers the same functionality as Page Safe. Whether they offer it for free, or as a paid product, that depends on who makes it.
Yes Joe Workman created a stack to “Frontendize” Sitelok because many people want to install and use a complete product without reading the documentation and learning how to use it. Personally, I find it easier to use Sitelok directly which is very well thought out to be integrated into the code just by copy-paste. So I don’t think it is useful for Joe to port his stack under Elements. On the other hand I have already teased him to port his TCMS 3 under Elements because a modern site builder without Blog or CMS is a bit like Frontpage without the text editor 
2 Likes
There is no need to multiply the exclamatory signs to indicate to me that my first answer has bothered you, I already noticed it.
To make it short: Elements without paid add-ons for what you want will not be done unless you definitively draw a line under third-party developers. Hence my first answer which implied DIY with a reflection on the dangers.
if you think that why keep replying!!!
???
Because I am a very tolerant person who likes to tease and be teased in return (maybe also a bit of masochism 
).
More seriously, the point your question raises is about the promise that Elements would be enough without needing to invest hundreds of euros/dollars/pounds… in add-ons. It won’t be as “free” as advertised unfortunately.
well the site ive created so far is as good as I need barring a couple of minor things which is coming in the next beta so for me it will be ‘‘free’’ as in no more add ons needed. I dont need the lock bit was just a simple question for Realmac which youve turned into a massive pile of doo dah. Dan answered my question…which was a yes or no question. please dont reply…getting bored now!!!
1 Like
I have already written some Elements Custom Components to support Sitelok. It is working well for me. I am waiting for the Elements Custom Component Developer Packaging to be made available before I release it. I won’t be charging for it and will be available as-is.
As @BrunoB says, it is perfectly possible to use Sitelok in Elements with code snippets. I created the Sitelok Custom Component to make it easier to use. 
3 Likes
when I looked at sitelok before in Rapidweaver classic scenario I thought was a bit complicated for whet I needed…Page Safe was way easier to do…just a 4 digit code opened the page…it’s not a dealbreaker for me if it’s not a component was just a question. I never mentioned sitelok at all in my question. and im not interested in it at all.
I have already written some Elements Custom Components to support Sitelok. It is working well for me. I am waiting for the Elements Custom Component Developer Packaging to be made available before I release it. I won’t be charging for it and will be available as-is.
That’s good news! I’m interested and even would pay for it 
1 Like
This is really cool, can’t wait to see what you’ve come up with when you release it.
If you would still like to lock down some of your pages without Page Safe, and if you happen to be using a web host that is using cPanel as their control panel, it’s really easy to password protect certain pages from the cPanel. There’s a feature in there to password protect directories.
It’s not as pretty as page safe, but it gets the job done if you want to lock some pages behind a password prompt. And it’s free, so no need to pay anything.