OnlineGet expert advice in online chat
Create an accountLog in
  1. Blog
  2. Manuals

Password-Protect a Website Directory with .htaccess and .htpasswd

4 min readUnixHost team
Password-Protect a Website Directory with .htaccess and .htpasswd

Basic HTTP authentication is the quickest way to close part of a site to outsiders: an admin panel, a staging copy, a directory with internal files. The browser asks for a login and password before the page even loads, and bots brute-forcing the admin area never reach the login form.

How it works

Two files are needed:

  • .htpasswd — a list of users with password hashes;
  • .htaccess — a file in the protected directory that turns the check on and points to .htpasswd.

This works on the Apache web server and on LiteSpeed, which is compatible with it — the servers used on most shared hosting plans. The Nginx setup is covered at the end.

Step 1. Create the password file

On a server with SSH access, use the htpasswd utility. It comes with the apache2-utils package (Debian, Ubuntu) or httpd-tools (AlmaLinux, Rocky Linux).

htpasswd -c -B /home/user/.htpasswd admin
  • -c creates a new file;
  • -B uses the strong bcrypt algorithm;
  • admin is the user name.

The utility asks for the password twice. To add another user, run the command without -c — otherwise the file is overwritten:

htpasswd -B /home/user/.htpasswd editor

Remove a user:

htpasswd -D /home/user/.htpasswd editor

Without SSH access, use the directory protection section of your hosting control panel: it creates both files for you.

Step 2. Create .htaccess

In the directory you want to protect, create a .htaccess file:

AuthType Basic
AuthName "Restricted area"
AuthUserFile /home/user/.htpasswd
Require valid-user
  • AuthName — the text the browser may show in the login dialog;
  • AuthUserFile — the absolute path to the password file on the server;
  • Require valid-user — access for any user listed in the file.

Protection covers the directory and everything below it. Run pwd in the directory to get its absolute path.

Access for specific users only

Require user admin editor

Protecting a single file

To put one file behind a password, for example the WordPress login page, wrap the directives in a Files block:

<Files "wp-login.php">
    AuthType Basic
    AuthName "Restricted area"
    AuthUserFile /home/user/.htpasswd
    Require valid-user
</Files>

This noticeably lowers the load from password-guessing bots: requests are rejected by the web server and never reach PHP.

Password or trusted IP address

A handy setup for an office: let the office address in without a password and everyone else only with one.

AuthType Basic
AuthName "Restricted area"
AuthUserFile /home/user/.htpasswd

<RequireAny>
    Require ip 198.51.100.7
    Require valid-user
</RequireAny>

To require both the address and the password, replace RequireAny with RequireAll.

Test

Open the protected address in a private browser window — a login dialog should appear. From the shell:

curl -I https://example.com/admin/
curl -I -u admin:password https://example.com/admin/

The first command should return 401, the second 200.

If it does not work

  • Error 500. A typo in .htaccess or a wrong path in AuthUserFile. The web server’s error log has the details.
  • No password prompt. .htaccess processing is disabled. The Apache configuration for the site directory needs AllowOverride All or at least AllowOverride AuthConfig.
  • The password is rejected. Check the file path and that the web server can read it: chmod 644 .htpasswd.
  • The dialog keeps reappearing. Wrong login or password; both are case-sensitive.

The Nginx equivalent

Nginx does not read .htaccess. Protection is set in the site configuration:

location /admin/ {
    auth_basic "Restricted area";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

The password file is created with the same htpasswd utility. After the change, run sudo nginx -t && sudo systemctl reload nginx. More configuration examples are in the Nginx virtual host guide.

Limits of this method

  • HTTPS only. With basic authentication the password is sent with every request almost in clear text. Without an SSL certificate anyone who can see the traffic can capture it.
  • No log-out. The browser remembers the password until it is closed.
  • No brute-force protection. The web server itself does not limit attempts — on your own server, add Fail2Ban.

Basic authentication is a good extra barrier in front of an admin area or a staging site, but it does not replace a proper account system.

Related articles