You can password protect specific directories on your website very easily in just a few minutes. You might want to password protect a directory to:<\/p>\n
<\/p>\n
Some commercial web hosts which offer a control panel (like cPanel, for example) will allow you to password protect a directory in a few short steps with the click of a mouse. The process in cPanel is this:<\/p>\n
If you don't have access to this control panel, or would prefer to do it manually, we can use built-in Apache functions to achieve the same thing.<\/p>\n
To get started with password protecting your directory, you'll need the following:<\/p>\n
The first thing we need to do is set up your .htaccess file so that the web server knows where to look for the password file and the authentication type as well. Your .htaccess file should look like this:<\/p>\n
\r\nAuthName "Password Protected Area"\r\nAuthType Basic\r\nAuthUserFile \/your\/directory\/.htpasswd\r\nrequire valid-user\r\n<\/pre>\nThe AuthName<\/strong> line will be shown in the browser to anybody trying to access the folder and you can change this to whatever you'd like to give more details about what the directory is.<\/p>\n
AuthType<\/strong> lets the server know what type of authentication is needed. Setting this to Basic is the common type of authentication. If you plan to password protect sensitive data, you'll need to use SSL (Secure Sockets Layer) encryption. That's beyond the scope of this tutorial, though. For now, leave this as Basic.<\/p>\n
AuthUserFile<\/strong> is where we will point the server to our password file. We will create that file in the next step and it should ideally be located outside of a folder which is accessible from a web browser. So if your site files are in
\/my-site\/public-html\/<\/code> you might want to put this file one directory back, into\/my-site\/<\/code> to avoid this file being accessed via the web.<\/p>\nAlways be sure to use the entire path to this directory.<\/p>\n
Once you've made these changes, you can save your .htaccess file and upload it to the directory you want to protect using FTP.<\/p>\n
Setting up your .htpasswd file<\/h4>\n
To create your directory password file, log in to your server using secure shell (SSH) and find your home directory (which can usually be done by using the change directory command cd<\/strong> and then pressing Enter).<\/p>\n
(Note: your password file can be named whatever you like, but for ease we'll use .htpasswd in this tutorial)<\/p>\n
Use the following command to create your password file with a username:<\/p>\n
\r\nhtpasswd -c .htpasswd user-name\r\n<\/pre>\nThe
user-name<\/code> should be a single world with no spaces and once you press return you'll be prompted to create a password for this user as well. The htpasswd<\/strong> utility built into Apache will create the password file for you (in this case.htpasswd<\/code>) and place it in your current directory.<\/p>\nYou can move this file to a different directory if you specified a different location in your
AuthUserFile<\/code> line of .htaccess.<\/p>\nTo add passwords to your file for additional users you want to grant access to the directory, you use a slightly different command:<\/p>\n
\r\nhtpasswd .htpasswd another-user-name\r\n<\/pre>\nIn this command,
-c<\/code> is not used since we already created the file we need. Without that part of the command, Apache will instead look for the existing file, which is.htpasswd<\/code>.<\/p>\nBe careful, because if you do use
-c<\/code> it will overwrite the original file and create a new one.<\/p>\nViewing the contents of your .htpasswd file<\/h4>\n
To check whether you have done everything correctly, you can view the content of the password file you created with another quick command:<\/p>\n
\r\ncat .htpasswd\r\n<\/pre>\n
cat<\/code> is a popular command which allows you to do various different tasks. In this case we're using it to view a file. In the file, usernames are stored in plain text, next to an encrypted password. Your password file might look something like this:<\/p>\n\r\nsitebeginner:p4tlgmcX2fE7NsP\r\nanotheruser:82ckb2esd7VLLU11\r\n<\/pre>\nYou can see that this file has two users and are paired to the password using
username:password<\/code>. These passwords are not the actual passwords you chose, and they are encrypted using one of a few encryption types depending on the server set up.<\/p>\nChecking the permissions of your .htpasswd file<\/h4>\n
We need to make sure your password file has strong permissions so that they can't be accessed by anybody else. To do this, we can list the files in a current directory using this command:<\/p>\n
\r\nls -al .htpasswd\r\n<\/pre>\nThe
ls<\/code> command shows the list of files in a directory and -al means to show all listings, and the long version of those listings (including the permissions of the file – which is what we want).<\/p>\nIf your htpasswd file has a listing like the following, we need to make some changes:<\/p>\n
\r\n-rw-rw-rw- (more outputs) .htpasswd\r\n<\/pre>\nThe first
rw<\/code> means the file is readable and writeable by the owner (you), which is what we want. But the second and thirdrw<\/code>‘s means that it is also readable and writeable by everyone in the same user group as you and anybody who has an account on the server, too.<\/p>\nWe need to make this more secure by changing the permissions to:<\/p>\n
\r\nchmod 644 .htpasswd\r\n<\/pre>\nThis will change the file permissions of your password file to 644, which gives you read and write access, but only read access to everybody else.<\/p>\n
Testing your password protected directories<\/h4>\n
The final step is to use your web browser and visit the directory you've password protected to make sure it requests a username and password, and allows access once you have provided the correct credentials.<\/p>\n
It it works, you'll have access to the folder and any files contained within it.<\/p>\n","protected":false},"excerpt":{"rendered":"
A tutorial using Apache, .htaccess and the htpasswd utility to password protect a directory on your website or server.<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"_monsterinsights_sitenote_active":false,"_monsterinsights_sitenote_note":"","_monsterinsights_sitenote_category":0,"_genesis_hide_title":false,"_genesis_hide_breadcrumbs":false,"_genesis_hide_singular_image":false,"_genesis_hide_footer_widgets":false,"_genesis_custom_body_class":"","_genesis_custom_post_class":"","_genesis_layout":""},"categories":[65],"tags":[],"_links":{"self":[{"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/posts\/1231"}],"collection":[{"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/comments?post=1231"}],"version-history":[{"count":0,"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/posts\/1231\/revisions"}],"wp:attachment":[{"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/media?parent=1231"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/categories?post=1231"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/sitebeginner.com\/wp-json\/wp\/v2\/tags?post=1231"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}