Apache Protected Folder – How to

Password-protecting a directory served by Apache is one of those things you set up once and forget. The recipe below is the one I used on a local Windows Apache install back in 2009 — and the core of it (htpasswd plus a .htaccess file) has not changed since. What has changed is Apache 2.4’s authorization syntax, so this version reflects the current Apache authentication how-to.

Where things live

• Plain Windows install: Apache in C:\apache\, config in C:\apache\conf\
• WampServer: C:\wamp\bin\apache\apacheX.X.X\, config in its conf\ subfolder
• XAMPP on Linux: usually /opt/lampp/etc/ (or /etc/httpd/conf/ on RPM-style installs)

Step 1 — Allow overrides

Open httpd.conf and make sure .htaccess files are honored. The default AccessFileName .htaccess directive already handles that; what matters is the AllowOverride setting for the directory you want to protect:

<Directory "/apache/htdocs/secure">
    AllowOverride All
    Options None
</Directory>

The old Order deny,allow line has no place here anymore — Apache 2.4 replaced the order-based model with the unified Require syntax.

One Windows-era trick that still works: if your editor refuses to save a file named .htaccess, add AccessFileName ht.acl .htaccess to the config and name the file ht.acl instead.

Step 2 — Create the password file

From Apache’s bin directory:

htpasswd -c -B /apache/passwd/passwords username

-c creates the file (use it only for the first user — running it again wipes existing entries) and -B stores a bcrypt hash, which is what you want. I originally recommended -b to pass the password on the command line; don’t — it lands in shell history and process listings. Let htpasswd prompt for it, and point AuthUserFile at a location outside your document root.

Step 3 — The .htaccess file

Drop this into the directory you want to protect:

AuthType Basic
AuthName "My Secured Folder"
AuthUserFile /apache/passwd/passwords
Require valid-user

Restart Apache (just in case) and browse the folder — you should get the familiar authentication dialog:

Two things I wish I’d known in 2009

• Basic auth sends credentials in base64, not encrypted. Over plain HTTP anyone on the wire can read them. Fine for a LAN dev box; use HTTPS for anything else.
• On shared hosting you usually don’t need any of this. cPanel and friends expose the same setup as a “Directory Privacy” page — if you’re paying a host, ask them or click the button.