Protecting a Page with a Password in Evolution CMS

Sometimes you do not need a full member area. You simply need one page or section to stay closed until a visitor authenticates or passes a controlled entry flow. Evolution CMS gives you several ways to do that, and the right choice depends on how formal the access control must be.

Option 1: protected resources and web user groups

If visitors already have accounts, the cleanest solution is to use protected resources together with web user groups. After login, only users in the allowed group can open the page.

Option 2: login form before entry

If you want a public login form on the site, FormLister or another login flow can collect credentials and sign the web user in before redirecting them to the protected resource.

Option 3: a lightweight password gate

If this is not a full account-based area and you only need a temporary access gate, a custom snippet can check a password, write a session flag, and redirect the visitor to the restricted page. This is simpler, but it is weaker than real user accounts and should not be used for sensitive data.

Recommended rule

• for real customer or staff areas, use web users and groups
• for temporary campaign access, a session-based gate can be acceptable
• do not treat one shared password as a strong security boundary

If you already tried FormLister and the result was “invalid username or password,” the first thing to verify is whether the login flow is using the correct authentication context and whether the target account is a web user rather than a manager user.