Password Protecting Your Pages with htaccess
Learn how to use Apache's .htaccess files to protect pages on your site with a username and password.
You may have visited a web page that pops up a dialog box similar to this one:
If you don't know the username and password to enter, then you can't access the page or site - it's "password protected". It's sometimes handy to be able to password protect your pages like this - for example:
You're building a new site, but you only want yourself (and maybe a select few) to be able to view the work-in-progress.
You have an area of your site that you never want the general public to have access to - for example, your web stats or private pages.
You have some paid (subscription) content on your site that only subscribers should be able to access.
Apache lets you password protect individual files, folders, or your entire site fairly easily. Read on to find out how it's done.
How it works
To add password protection to your pages, you need to do the following two things:
- Create a text file on your server that will store your username and password.
- Create a special file called
.htaccessin the folder you want to protect.
That's it! Now let's take a look at how to do each step.
Creating the password file
The first step is to create a simple text file that will store your username and password, separated by a colon (
:). The small catch is that the password must be encrypted. Luckily, there are many free web-based utilities that will encrypt the password for you. Try one of these:
- 4WebHelp's online .htpasswd encryption tool
- Alterlinks .htaccess password generator
- htmlite's htpasswd encryption page
Simply enter your desired username and password in one of these pages and submit the form. You'll get back a string similar to the following:
Now, open up your favourite text editor (e.g. Notepad or TextEdit), then copy and paste the username/password string into the editor. Save the file and call it
Next, upload this file to your website. Make sure you place it outside the Web root of your site if possible, as you don't want just anyone to be able to view the file! For example, place it above your
htdocs folder. (Having said this, Apache is often set up by default to block web-based access to files beginning with
.ht. Better safe than sorry though!)
If you can't place your
.htpasswd file outside your Web root, name it something that's not easily guessable - for example,
.htxuymwp - so that people won't be able to find it easily. (In addition, it helps to start the filename with
.ht; as mentioned earlier, Apache usually blocks access to files starting with
Alternative: Creating the password file using
If you have SSH access to your web server (or you're running Apache on a local machine), you can encrypt your password and add it to your password file in one go by using the
htpasswd utility that comes with Apache. Simply SSH to your server or open up a terminal window on your local machine, cd to the folder where you want to create your password file, and type:
(where fred is the username you want to use). You'll be prompted to enter and retype your password, then the
.htpasswd file will be created for you.
Now that you have created and uploaded your password file, you need to tell Apache to use it to protect your page(s) or site. This is what your
.htaccess file will do.
Open your text editor again, create a new file, and save it as
Protecting a folder
To password protect a folder on your site, you need to put the following code in your
AuthUserFile /full/path/to/.htpasswd AuthType Basic AuthName "My Secret Folder" Require valid-user
/full/path/to/.htpasswd should be the full path to the
.htpasswd file that you uploaded earlier. The full path is the path to the file from the Web server's volume root - for example,
C:\wwwroot\username\.htpasswd. (If you're not sure of the full path to your site or home directory, ask your Web hosting company for this info.)
.htaccess file will password protect all files in the folder that it is placed in, and all sub-folders under that folder too. So if you wanted to password protect your entire site, you would place the
.htaccess file in your Web root folder.
Protecting a file
To password protect just a single file in a folder, use the following
AuthUserFile /full/path/to/.htpasswd AuthType Basic AuthName "My Secret Page" <Files "mypage.html"> Require valid-user </Files>
This will password protect just the
mypage.html file in the folder where you put the
Once you've created your
.htaccess file, upload it to your website, placing it in the folder (or folder containing the file) that you want to protect.
Testing it out
Now use your Web browser to visit the folder or file that you've protected. You should see a password dialog like the one shown at the start of this tutorial. Type in the username and (unencrypted) password that you chose earlier, and you should be given access to your folder or file!
(By the way: with this type of password protection, you continue to have access to the password protected stuff until you restart your browser.)
If you can't access your stuff and the dialog keeps popping up, check that you entered the username and password correctly. If it still doesn't work, check the path to your
.htpasswd file on the server - make sure the path specified in the
AuthUserFile directive is correct. Also make sure that both the
.htaccess files are readable by the Web server user (
chmod 644 should do the trick for UNIX/Linux/FreeBSD servers).
If the password protection isn't working (i.e. you can still access your stuff without needing to enter a username/password), check that you uploaded your
.htaccess file to the right folder. Also check that your web server supports
.htaccess password protection (it needs to be an Apache server, and your server admin needs to have enabled the
AuthConfig override for your site).
Password protecting more stuff
- If you want to password protect other folders (that aren't under the currently protected folder), simply copy your
.htaccessfile to the new folder to be protected.
- To password protect more than one file in the same folder, just create more
<Files></Files>blocks within the same
.htaccessfile - for example:
AuthUserFile /full/path/to/.htpasswd AuthType Basic AuthName "My Secret Page" <Files "mypage.html"> Require valid-user </Files> <Files "myotherpage.html"> Require valid-user </Files>
Adding more usernames and passwords
You're not restricted to just one username/password. If you want to add other usernames and passwords, simply repeat the "Creating the password file" procedure above, but add each new username/password line to your existing
.htpasswd file, e.g.:
Alternatively, if you're using
htpasswd to create your passwords, as described earlier, then you can add extra users with the command:
linda is the username you want to add). Make sure you don't include the
-c option when adding additional users, or
htpasswd will attempt to create a new password file!
For full information on Apache's
mod_auth module (the module that does password protection, amongst other things), see the Apache
Responses to this article
20 most recent responses (oldest first):
client denied by server configuration: it was because I was allowing dir listing in the folder to fix that I added.
IndexIgnore .htaccess to the .htaccess fixed the errors when it tried to read the dir listing every time.
# adding fancy directory indexing
Thanks again for the nice how to..
I'm working on a script that will allow users in the system to "auto login" or ftp to a password protected folder from a link provided to them. Is this even possible and if not with .htaccess is there another way?
[Edited by tommie on 08-Feb-11 18:48]
You can specify a username and, optionally, a password in an ftp:// URL:
Once I've successfully entered the protected page using this method and I close the window, the next time I visit the protected page it doesn't ask me for a password anymore.
So question is, how secure is this?
If you need to support timeouts and logouts then the best bet is to use server-side code (PHP, ASP etc) with sessions. This also gives you more security since the credentials aren't sent by the browser with every request - only the session ID is sent.
I put the password above the root directory.
Everything works well, except that if instead of entering a username and password, I just hit cancel, it takes me right into the directory I was trying to protect.
If I want to password protect this new page with different passwords, am I out of luck? Is my only option to put it in the same folder with the already password-protected page, and use the same password as it? Any suggestions on what I should do?
Bearing in mind of course that a .htaccess file applies to all subdirectories off the directory as well.
If so, the directives in that will cascade along the entire directory tree and take precedence over 'local' .htaccess directives.
I also specified:
Require user shinycrayons
If I want to password protect another page in the same folder, what would I enter?
I'm new to this, so thanks for your help in advance!
The IfModule directive is not required, it is simply a check that Apache has been compiled with mod_auth included
AuthName "Username and password required"
If you want different usernames and passwords for different filenames you add name:password pairs in .htpasswd
and use Files or FilesMatch directives for each file name
The thing to be wary of is going over the top with htaccess directives, simply because it is loaded and read on every request to the server. So a few dozen lines of directives can add a significant extra load to a fairly busy server.
[Edited by chrishirst on 20-Nov-13 09:53]
What can I do?
I got it working without any problems (to restrict access to some short videos).
My query is: Is there any way to change the default wording that is displayed in the authentication window.
"A username and password are being requested by http://www.website.co.uk. The site says: 'EnterPassword' ." I know you can change the "EnterPassword" with new text in AuthName but the sentence 'The site says...' is superfluous. Actually a simple 'Please enter Username and Password' is all that's required and would look much better. Can this be done?
If anyone knows, I'd appreciate it. Thanks in advance.
Post a response
Want to add a comment, or ask a question about this article? Post a response.
To post responses you need to be a member. Not a member yet? Signing up is free, easy and only takes a minute. Sign up now.