Portal Entry Guard

Description

Portal Entry Guard allows you to protect selected WordPress pages with a lightweight email access gate.

Visitors must enter a valid email address before accessing a protected page. No user account, OTP, or email verification is required.

The plugin is designed to be simple, lightweight, and easy to configure.

Features

• Protect selected WordPress pages.
• Select multiple pages from the plugin settings.
• Easily unselect pages to remove protection.
• Simple email-based access form.
• No OTP or email verification required.
• Configurable access duration from 1 to 365 days.
• Secure token-based visitor access.
• Nonce-protected form submission.
• Email addresses are stored for access tracking.
• Administrator users with the manage_options capability can bypass the gate.
• Responsive and lightweight frontend design.
• No page builder dependency.

Configuration

After activation, go to:

Settings > Portal Entry Guard

Protected Pages

Select the pages that should require email access.

You can select multiple pages and unselect previously selected pages at any time.

Remember Visitor For

Set how many days a visitor should retain access to protected resources.

The available range is 1 to 365 days.

Gate Title

Customize the title displayed on the access page.

Description

Customize the message displayed above the email form.

Privacy Text

Add a short privacy message explaining how the visitor’s email address will be used.

How It Works

When a visitor opens a protected page:

1. The plugin checks whether the page is protected.
2. If the visitor does not have a valid access token, the email gate is displayed.
3. The visitor enters their email address.
4. The email address is validated.
5. A secure access token is generated.
6. The token is stored securely and associated with the protected page.
7. The visitor receives access to the protected page.
8. Access remains available until the configured expiration period.

Security

Portal Entry Guard uses:

• WordPress nonces for form validation.
• Sanitized email input.
• Secure random token generation.
• SHA-256 token hashes in the database.
• HTTP-only cookies.
• SameSite cookie protection.
• Expiration timestamps for access tokens.
• Capability checks for administrator bypass.

Privacy

The plugin stores email addresses submitted through the access form along with access-token information.

Site administrators are responsible for configuring their privacy policy and ensuring that the plugin’s use complies with applicable privacy and data-protection requirements.