Welcome! Wappler can easily handle restricted/protected sites.
I would suggest moving to node.js for your projects since that is a newer technology where a lot of new features are available; use docker on your local and remote projects to make migrations/promotions easier; and read up on the main parts of Wappler. I recommend reading up on the Database Manger, and Resource Manager and using them when creating database tables and remote servers. It'll make managing those parts of the system simpler.
You can find most of the docs here: https://community.wappler.io/c/docs/28
Wappler also has a basic permission system built into the Security Provider component that you add to your APIs. If you are looking for something that's a little more robust you can get some ideas from the design I setup.