Step-by-Step Setup: CoffeeCup Website Access Manager for Small BusinessesRunning a small business means juggling security, convenience, and cost. If your website includes member-only content, client portals, or internal pages for staff, controlling who can access which parts of your site is essential. CoffeeCup Website Access Manager (WAM) is a lightweight, user-friendly tool designed to help website owners password-protect pages and manage user access without needing complex server setups or deep technical knowledge. This guide walks you through a complete setup for small businesses, covering planning, installation, configuration, user management, and best practices.
Why choose CoffeeCup Website Access Manager?
- Simple integration with static and dynamic sites created with CoffeeCup products and other HTML-based builders.
- Password protection for individual pages, folders, or entire sites without modifying server configurations.
- User management that supports multiple user accounts and role-based access.
- Affordable and lightweight, making it suitable for small businesses that don’t need enterprise-grade identity systems.
Before you start: planning and prerequisites
- Assess what needs protection:
- Client portals, pricing pages, download areas, staff-only pages, draft content.
- Choose access rules:
- Per-page passwords, folder-level protection, user-specific login, or time-limited access.
- Gather assets and accounts:
- Your website files (HTML/CSS/JS), FTP or hosting control panel access, CoffeeCup WAM installer or plugin (if using a CoffeeCup site builder).
- Backup:
- Make a full backup of your site files and any existing .htaccess or server configuration you might alter.
Installation options
CoffeeCup Website Access Manager can be used in a few common scenarios. Pick the one that matches your setup:
- Using CoffeeCup Site Designer or Visual Site Designer:
- WAM integrates through CoffeeCup’s product ecosystem; download the extension or use built-in options in the product menu.
- Static HTML site on shared hosting:
- Upload the WAM files (typically a PHP-based gate script, config file, and assets) to your hosting via FTP.
- CMS or custom server:
- If using a CMS or framework, you might embed WAM’s gate script into templates or use a CoffeeCup plugin if available.
Step-by-step setup (generic FTP/HTML approach)
- Download WAM package:
- Obtain the Website Access Manager ZIP from CoffeeCup or within your CoffeeCup app.
- Unzip and inspect:
- Typical files: gate.php (or index.php), wam-config.php (or similar), css/ and images/.
- Upload to your server:
- Use FTP/SFTP or your hosting file manager. Place files in the directory you want to protect, or in a central location if protecting multiple folders.
- Configure wam-config.php:
- Open the config file in a text editor. Key settings include:
- Admin credentials (username/password) — store securely.
- Protected paths — list files/folders to guard.
- Login page URL and redirect on success.
- Session duration and cookie options.
- Open the config file in a text editor. Key settings include:
- Protect a folder or page:
- For folder-level protection, place the gate files in that folder and ensure directory index loads the gate script, or add an .htaccess redirect to the gate.
- For page-level protection, include or require the gate script at the top of pages you want to protect, e.g.,
<?php require_once '/path/to/gate.php'; ?>
.
- Test access:
- Visit a protected page in an incognito window. Confirm it prompts for login and that credentials work.
- Set up SSL:
- Ensure the protected area is served over HTTPS to protect credentials in transit. Use Let’s Encrypt if your host supports it.
Adding and managing users
- Admin interface:
- Many WAM installs include a small admin panel accessible via admin credentials configured earlier.
- Create users:
- Add usernames, strong passwords, and assign roles or group access if the system supports it.
- Password policies:
- Enforce minimum length and complexity. Consider expiration for sensitive areas.
- Bulk user import:
- If you have many clients, import via CSV if WAM supports it, or script user creation.
- Single-use and time-limited access:
- For contractors or temporary clients, configure one-time or expiring logins when available.
Integration tips for small businesses
- Client portals:
- Combine WAM with simple database-driven pages for client-specific files. Use unique folders per client protected by WAM.
- Downloads and digital products:
- Protect product download pages and store files outside the webroot; serve via a script after verifying session.
- Team pages:
- Use role-based folders (e.g., /staff/, /accounting/) with different credentials.
- E-commerce checkout pages:
- Do not rely on WAM for payment security; use your payment provider’s secure checkout and ensure SSL.
Security best practices
- Use HTTPS sitewide.
- Store admin/config passwords hashed where possible.
- Keep WAM and CoffeeCup tools updated.
- Limit admin login attempts to reduce brute-force risk.
- Audit access logs periodically.
- Back up both site files and the access manager’s configuration and user database.
Troubleshooting common issues
- Login not appearing:
- Check PHP is enabled and the gate script is accessible; ensure file permissions are correct.
- Redirect loops:
- Verify login redirect paths and ensure protected pages don’t redirect back to the login indefinitely.
- Sessions not persisting:
- Confirm PHP session settings and that cookies are allowed; check domain/path settings in config.
- Mixed content warnings:
- Serve all assets (CSS/JS/images) over HTTPS.
Example: Protecting a client folder (quick code snippet)
Place this at the top of the pages in the folder (or in a shared header):
<?php require_once '/path/to/wam/gate.php'; ?>
Maintenance checklist
- Monthly: check for updates and review user list.
- Quarterly: rotate admin credentials and review logs.
- After changes: test access flow when you modify site structure or move files.
Final notes
CoffeeCup Website Access Manager is a practical, low-cost way for small businesses to control page access without heavy infrastructure. For simple client portals, private downloads, and staff-only pages it provides a fast path to stronger access controls—just remember to pair it with HTTPS, good password hygiene, and periodic review.