Demo mode FAQ
Short answers about demo mode, for anyone who runs, shows, sells or teaches with a public demo of Exponential. The full reference is Demo mode: the upgrade note; the administrator's view is Demo mode.
Warning
.htaccess slows down every request. When .htaccess files are enabled (AllowOverride anything but None), let alone
used, Apache looks for them and reads and evaluates them on every request, in every directory of the path, and
page loading times go up drastically (measured). The only real fix is to switch the feature off for
the virtual host: AllowOverride None in the HTTPS virtual host, and the rules in the virtual host's own
configuration as mod_rewrite rules. That is far faster in production speed tests and well worth the time it takes
to optimize a production configuration. Switch over right away: copy the rules of the
example HTTPS virtual host into your virtual host (with the static cache, also
staticcache_offload.conf), set AllowOverride None, run apachectl configtest, reload Apache and
test the site. The same rules for other servers: nginx, LiteSpeed,
Caddy, IIS, Velocity (built in); where virtual host rules go in a control
panel: Plesk, cPanel, DirectAdmin, ISPConfig.
On LiteSpeed or OpenLiteSpeed, the server's own page cache can also answer anonymous visitors and crawlers without PHP: Page caching with LiteSpeed and OpenLiteSpeed.
Contents
- What is demo mode for?
- What does it block?
- What does it not block?
- How do I switch it on?
- Why is there no setting for it?
- Which passwords do the installers accept in demo mode?
- How do I know it is on?
- Who counts as an administrator?
- Can I use it on a real site?
- How do I switch it off?
- Related pages
What is demo mode for?
For a public demo: a site whose administrator sign-in is published so that anyone can try the administration. Without demo mode the first visitor could change the administrator password and lock everyone else out. With it, administrator passwords cannot be changed or reset, so the published sign-in keeps working until the next rebuild.
What does it block?
Every way of setting a new password for an administrator: the Change password page, Forgot your password?
(no reset mail is sent; the page tells every visitor that administrator passwords cannot be reset), the password field
of the user account in the edit form, exp:resetuserpassword (also with --allow-root-user), the web services, the
user/password and user/forgotpassword operations, and any code that stores a user: the kernel keeps an
administrator's stored password. Each refusal says "This installation is a public demo: the passwords of
administrators cannot be changed or reset." and is recorded in the audit with the reason demo_mode.
What does it not block?
Everything else. An administrator on a demo can still edit content, create accounts, change roles and settings, install packages and upload files, so a demo is rebuilt on a schedule. Other accounts (editors, members) change and reset their own passwords as usual, with all the usual rules. Signing in is never affected.
How do I switch it on?
Set the environment variable EXP_DEMO_MODE=1 for every PHP process of the demo: the web server's PHP (.htaccess
or virtual host SetEnv, the PHP-FPM pool, nginx's fastcgi_param, the environment of Exponential Velocity), the
cron jobs and the console. Ready-made files: Demo mode examples; a complete setup:
Recipe: run a public demo on LiteSpeed and Plesk.
Why is there no setting for it?
So that it cannot be switched on by accident. An INI setting would travel with a copied settings directory, a
restored database or a package; a request parameter could be sent by anyone. The environment belongs to the server of
one site. Only the exact value 1 counts; 0, true, yes and on leave it off.
Which passwords do the installers accept in demo mode?
The administrator password of a new installation may be well-known and shorter than MinPasswordLength, so
publish and publishing are installed as given by the setup wizard, the kickstarter and exp:install. An empty
password is still refused (the kickstarter and exp:install generate one). Every other account, and every password
set after the installation, keeps every rule. Without demo mode the installers replace such a password with a
generated one.
How do I know it is on?
- The administration shows a yellow Demo mode banner on every page.
var/log/security.loghas ademo/mode on pid=... sapi=...line for every process that started with it.- The audit has a
system.demo.modeevent per process. - Console commands print
Demo mode is on (EXP_DEMO_MODE=1) ...on standard error.
Who counts as an administrator?
An account whose roles give it unlimited access to every module and function: admin, everyone in Administrator
users, and anyone with the Administrator role. An account whose roles cannot be read counts as one too.
Can I use it on a real site?
No. Demo mode means the administrator password is meant to be known and cannot be changed. Never set the variable
server-wide, in a shared pool, a base image or a template other sites are built from. If the banner or a demo/mode
line ever appears on a real site, remove the variable at once: Demo mode problems.
How do I switch it off?
Remove the variable from every place it was set and reload or restart that service (PHP-FPM, the web server, Velocity) and the crontab. There is nothing to undo in the database: once the variable is gone, passwords can be changed again, and the banner disappears with the next request.
Related pages
- Demo mode, Demo mode: the upgrade note
- Demo mode for hosts, Demo mode for developers
- Demo mode problems
- Environment variables
- Free documentation: this page is free to copy, translate and improve under the GNU FDL 1.3.
Become an Exponential Partner
Partners share their information, provide funding, contribute back and develop the products with us, and that is how Exponential grows. A partner website and dashboard are planned for mid-2027: please become a partner today to speed up our growth rate and land new features faster.