PreviewLab — Documentation
A simple preview password gate for Joomla 4, 5 & 6.
PreviewLab protects a development, staging, or coming-soon frontend behind one shared password. It is built for site owners, designers, and agencies who need clients or reviewers to access a private Joomla site without creating user accounts.
Requirements
- Joomla 4.0 or later (including Joomla 5 and Joomla 6)
- PHP 8.1 or later
- A Joomla site where requests reach Joomla before any full-page cache, CDN, or reverse proxy serves the page
Installation
- Download the
pkg_previewlab-1.0.8.zippackage file. - In your Joomla admin panel, go to System > Install > Extensions.
- Upload the package file and click Upload & Install.
- The installer will set up the PreviewLab system plugin and administrator dashboard module.
- Go to System > Manage > Plugins and open System - PreviewLab.
Getting Started
Protecting the Site
- Open System > Manage > Plugins.
- Edit System - PreviewLab.
- Set Enable preview protection to Yes.
- Enter a Preview password.
- Enable the plugin and click Save.
- Visit the frontend in a private browser window to confirm the password gate appears.
PreviewLab only protects the site frontend. The Joomla administrator area is excluded so admins can continue working normally.
Sharing Access
Send the preview password to approved reviewers. After they enter it successfully, PreviewLab stores access in their Joomla session for the configured session duration.
If Remember browser is enabled, PreviewLab can also store a signed browser cookie for the configured number of days. Changing the preview password invalidates existing sessions and remember-browser cookies.
Preview Gate Content
Use the Content settings to customise the screen reviewers see before they enter the site.
- Logo and Logo alt text - add site or client branding.
- Heading - default: "Website Under Development".
- Intro text - short message above the password field.
- Password label - label shown beside the password input.
- Button text - text for the submit button.
- Error message - shown after an incorrect password.
- Contact hint - optional support or access request note.
- Footer text - optional footer line below the gate panel.
The password field includes a show/hide control for easier reviewer access.
Appearance
PreviewLab includes a responsive gate screen that can be styled from plugin settings.
- Theme - light or dark.
- Background colour - page background.
- Panel colour - password panel background.
- Text colour - main text colour.
- Accent colour - button and focus colour.
- Background image - optional page background image.
- Background image blur - soften the uploaded background image.
- Custom CSS - add project-specific refinements when needed.
Access Rules
URL Exclusions
PreviewLab ships with safe defaults for paths that should usually remain available:
/administrator
/api
/cli
/media/system
/index.php?option=com_ajax*
Add one exclusion per line. A rule ending in * matches everything beginning with that path or URL pattern.
Media, API, and Feeds
Dedicated toggles control whether PreviewLab protects:
- Media - disabled by default, so
/mediaassets remain available. - API - disabled by default, so
/apiremains available. - Feeds - enabled by default, so feed requests are protected.
IP Allowlist
Add trusted IPv4 addresses or CIDR ranges, one per line. Matching visitors bypass the preview password.
Examples:
203.0.113.10
203.0.113.0/24
Rate Limiting
PreviewLab can limit repeated failed password attempts during a session.
- Rate limit enabled - turn failed-attempt protection on or off.
- Failed attempt limit - number of failed attempts before lockout.
- Lockout window - time window in minutes.
- Lockout message - message shown while locked out.
The default behaviour locks out a session after 5 failed attempts within 10 minutes.
Logout and Preview Status
PreviewLab includes a stable logout URL:
/?previewlab_action=logout
When Logout link enabled is on, authenticated preview visitors also see a small frontend status panel with a logout link. This helps clients and reviewers clear preview access without needing browser tools.
Administrator Dashboard Module
The package includes PreviewLab Control, an administrator module for quick daily use.
The module can:
- Show whether the frontend is open or protected.
- Enable or disable the system plugin.
- Enable or disable preview protection.
- Edit and copy the preview password.
- Link to the full plugin settings.
- Link to the site frontend.
To use it, publish PreviewLab Control in an administrator module position supported by your admin template.
Important Notes
PreviewLab runs inside Joomla. It cannot protect files or pages that are served before the request reaches Joomla, including content served directly from a CDN, reverse proxy, or static full-page cache.
For launch day, disable preview protection or unpublish the system plugin after the site is ready to go public.
Support
For help, feature requests, or bug reports, visit the PreviewLab page on the TDCLab extensions site: extensions.thedesigncompany.co.nz
Licence
PreviewLab is free software released under the GNU General Public License v2 or later.