Built-in Restricted Access page?

Yes, but customers will not want this. They always want some kind of branded maintenance page. I think we would need to rethink the previous Access Code page though as the static html file approach won't work any more.

The old plugin used unsupported APIs, sometimes caused issues, and there isn't a clear upgrade path for it. I'd recommend we use a built-in approach. That said, what level of customization would a customer want? Would being able to supply colors and a logo in addition to labeling be enough? Worth noting that, like the old maintenance page, this new built-in preview-mode middleware necessarily runs outside of the typical theming/widget/styling/API context.

Fully agree, they all want to use the page and implement their own branding and wording.