Hi, @LNathan !!
If you really are operating in such a dangerous region, sending a plaintext password in a single email seems risky to me. It also feels unsafe to protect the site with one fixed, shared password at all times. Ideally, you’d want to use something like a time-based one-time password that can be shared via Google Authenticator or a similar app. That would require some coding, but it should be possible to implement even on Wix.
That said, this approach involves fairly complex work, so it would probably be better to start with a simpler solution. First and foremost, the priority should be making the method of sending the password more secure.
If you’re comfortable with coding, one option would be to email an encrypted version of the password, and then send the decryption password through a different channel, such as SMS. You could also create a separate, dedicated site where users enter the decryption password to retrieve the real password. However, this too requires a reasonable amount of effort, so you may want to look for another approach.
I asked an AI about alternatives, and it turns out that a well-known password manager called 1Password offers a feature that lets you generate secure password-sharing links. If you send one of these shared links by email, that might help ensure the password is transmitted safely.
After that, users would access the main site using that password. To build the kind of functionality you’re aiming for, you’d likely need to use Wix’s router feature. In theory, you could make all pages accessible only through the router. But if that also feels too complicated, I’d still recommend using Wix’s member system.
I don’t know exactly what your concerns are with that feature, but if you disable automatic approval and require manual approval for new members, your own judgment becomes part of the process, and from a security standpoint, that doesn’t seem like a major issue. Alternatively, during the manual approval process, you could ask applicants to enter the “password” you previously sent them by email into a form. If the password matches, you can decide that this person is safe to approve as a member. For the amount of work involved, that could result in a fairly solid and well-balanced authentication process. 