Maintenance mode: bypass by IP, secret link or post type

How to use it

1. Turn on maintenance or coming-soon mode in Bricks > Settings > Maintenance mode.
2. In Bricks > Kiln, under Admin & agency, turn on Admin: maintenance mode bypass. Click Save modules. The module is off by default.
3. Open Settings under the module and fill in what you need.

Let specific people through by IP address

1. In Allowed IP addresses, enter one address per line, IPv4 or IPv6. The field shows your own address as the server sees it.
2. Click Save modules. Kiln drops lines that aren't valid IP addresses.

Let anyone with a link through

1. Click Save modules once with the module enabled. A Share link field appears.
2. Copy the link and send it. When someone opens it, Kiln sets a cookie that lasts 7 days on that browser and redirects to the same address without the token.
3. When the review is over, tick Make a new link when I save and click Save modules. The old link stops working, and so do cookies it already set.

Keep a post type public

1. Under Post types that stay public, tick the types you want. Media and My templates are not listed: templates would expose the maintenance page itself.
2. Click Save modules. Single pages, the archive (for products, the shop page) and category or tag pages of those types show to everyone. Ticking Posts also opens the blog page.
3. Clear your page cache. A cache may still hold the coming-soon page for those addresses, or the real page after you untick a type.

How it works with Bricks' own bypass

Bricks decides first. Its role bypass (the "bypass maintenance mode" capability per role, in Bricks > Settings > Builder access), its excluded pages and its login page are all checked before Kiln runs. Kiln can only let more visitors through. If Bricks already lets a visitor in, Kiln does nothing.

Kiln then checks, in this order: a public post type, an allowed IP address, a valid share-link cookie. Per-role bypass and single excluded pages are not part of this module because Bricks has them.

Caching

A response that Kiln lets through by IP address or cookie is marked uncacheable: the DONOTCACHEPAGE constant, LiteSpeed's no-cache call and no-cache headers. This keeps a page cache from storing the real site and showing it to anonymous visitors. Kiln leaves pages of a public post type cacheable, because everyone may see them.

A CDN rule that ignores those headers, for example Cloudflare "Cache Everything" with an edge TTL, can still cache the real site.

What Kiln checks

• Kiln generates the share-link token. You cannot type your own, and it must be at least 20 characters.
• The cookie carries its own expiry, and a signature that covers the expiry and the token. The server checks both.
• A redirect removes the token from the address bar, matched or not. A wrong token sets no cookie.
• Kiln matches IP addresses on REMOTE_ADDR only. Kiln never reads X-Forwarded-For.

Limits

• Each allowed address must match exactly. Ranges and CIDR notation such as 203.0.113.0/24 don't work.
• Behind a proxy or CDN, the server sees the proxy's address for every visitor. When Kiln sees headers such as CF-Connecting-IP, X-Forwarded-For, X-Real-IP or True-Client-IP, the Settings field shows a red warning and Kiln refuses to save the proxy's own address. Use the share link on those sites.
• Anyone who holds the share link can forward it. The link also appears in server logs like any other URL.
• The module only acts while Bricks' maintenance mode would otherwise block the visitor.

Settings

• Allowed IP addresses
• Post types that stay public
• Share link, with Make a new link when I save

Requirements

Bricks 2.4 or newer.