Software Development:
Individual Programming

Symptom

You want to limit the access to certain directories to users with a login name.

Cause

You can either create a password-protected directy with the .htaccess web server control or with the Plesk customer control panel. This article describes, how to use an .htaccess file to create password-protected directories.

Solution

1. You will need two files, an ".htaccess" file that controls the directory access and an ".htpasswd" file that contains a combination of login names/passwords. Start with creating the .htaccess text file with the following content:

AuthUserFile /[path/].htpasswd
AuthGroupFile /dev/null
AuthName "[Notice to users]"
AuthType Basic

require valid-user


Replace [path/] by a directory of your web space where the file shall be saved in that login name/password combinations are stored. You can also omit [path/], in that case the file will be stored in the home directory of your FTP login. An .htpasswd file should not be stored in a directory that can be accessed by the web server, because in could become visible on the Internet in that case.

Instead of "[Notice to users]" enter a prompt or a description of the protected directory, e.g. "Dealers only", "Price lists" or something similar.

2. Upload the .htaccess file into the directory that you want to protect with a password.

3. Create the .htpasswd file. This file stores the login name/password combinations. If you have access to a Linux shell you can create the file using the Linux htpasswd command:

htpasswd -c /[path/].htpasswd [login name]

Else use one of the many free online password generators, because the passwords in a .htpasswd-file cannot be stored in clear text, but must be encrypted. A typical .htpasswd file for two users "johndoe" and "janedoe" could look like this:

johndoe:$apr1$Q5SW6wj4$qvD3b8nBlfhdmDQLpU52/0
janedoe:$apr1$SsOahno9$ZgB3fM7U8joJwTFgLvzgd/

4. Upload the .htpasswd file to the location where it should be according to the .htaccess file setting ("[path/].htpasswd").

If the password protection does not work properly, the path to the .htpasswd file that you have entered into the .htaccess file is most likely incorrect.

Overview of frequently asked questions