Password based access to Web directories


[Note: If you are looking for information on how to change your own password for FTP or Telnet access, go to the Changing Your Password page]

This technique is used when you wish to prevent regular web users from accessing documents and other files in a sub-directory of your web site. This method is NOT available under the NT / Frontpage platform.

Password Protection Example

Create a directory, for this example we'll use "secret" within your public_html directory. It will appear as:
http://www.yourdomain.com/secret/

Create a .htaccess file within the "secret" directory with a UNIX text editor, such as pico or vi. Novice users are suggested to use pico. Type the following text into your .htaccess file:

AuthUserFile /export/home/username/passwords/.htpasswd
AuthName access
AuthType Basic
<Limit GET POST PUT>
require valid-user
</Limit>

Replace username with your login name. You may replace the passwords subdirectory with any name you like. Make sure to run
chmod 644 .htaccess

Browsers accessing files and subdirectories under the directory that contains the above .htaccess file will be prompted for username and password and authenticated with the contents of the AuthUserFile.

The AuthUserFile line specifies where your .htpasswd file is located. The .htpasswd file specifies the allowable users for the subdirectory as well as their passwords. The passwords in the file are encrypted. To completely secure the site, we recommend you place the .htpasswd file within your home directory but NOT within the public_html subdirectory. We suggest you create it in a subdirectory called "passwords" within your home directory.

Adding Users

  • Use the command /share/bin/htpasswd .htpasswd username
    If you are running this command for the first time, you will need to run it like this:
    /share/bin/htpasswd -c .htpasswd username
    If you are not within the same directory as the .htpasswd file, you will need to specify the path to it.

    • Removing Users

  • Open the .htpasswd file with a text editor under UNIX, such as pico or vi.
  • Remove the line with the username you wish to remove

    • Changing Users

  • Use the command /share/bin/htpasswd .htpasswd username
    where username is the user whose password you wish to change.

    • Here are some excellent links for password-protected directories for the Apache Web Server: