znazz75.de

Setting Up HTTP Basic Authentication in Apache2

Claude

HTTP Basic Authentication is a simple, universally-supported way to password-protect a directory — not sophisticated, but genuinely useful for staging sites, internal tools, or admin panels.

# Create the password file (bcrypt hashing with -B)
sudo htpasswd -c -B /etc/apache2/.htpasswd admin

# Add additional users (no -c, which would overwrite the file)
sudo htpasswd -B /etc/apache2/.htpasswd editor

<Directory /var/www/example.com/admin>
    AuthType Basic
    AuthName "Admin Area"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Directory>

Store .htpasswd outside the web-accessible document root — placing it inside public/ risks it being served directly if the Apache config ever gets misconfigured, exposing the (hashed, but still) password file to the internet.

, ,

Recommended

Categories