Protect a folder with htaccess

Description

We will see how we can protect a folder from a web server managed with Apache. You can generate an htaccess file from the form below. This script is not designed to be downloaded, but you can use it for free from this page.

The principle is the following : you have to put a file named ".htaccess" in the folder you want to protect with a password. This file contains some instructions that tells where the webserver will find the file with the names of authorized users.The second file, which I call pass.txt contains one row per authorized user and will look like, "username: encrypted password". Pass.txt file can be anywhere, but it is prudent to place it in a folder that is completely inaccessible from a browser (including for you).

Files creation

This first form is for creating the htaccess file (see howto below):

Copy / Paste the code below in a file named htaccess.txt :

This second form is for crypting the password and generate the pass.txt file :

Copy / Paste the code below in a file named pass.txt :

Howto

Complete the form above to get the files htaccess.txt and pass.txt (you can change the name of this file). The file to indicate in the first form is where you store your passwords. It must be stated with absolute address from the server root and with the file name. For example: /var/www/html/my_site/private/pass.txt.

You can find the absolute address of your file with the command phpinfo(). Just add this single line in a file and upload it to your server. Start your page in a browser and you will have many details, including the absolute path to your file pass.txt

Then transfer these files on your server in the right folders. Htaccess.txt has to be in the folder to protect. Rename htaccess.txt in .htaccess (with a dot at the beginning).

We must secure the folder that contains the file pass.txt denying access from the web for anyone (including yourself). For example, you can put a .Htaccess file containing :

Authname "Restricted Access"
AuthType Basic
<LIMIT GET POST>
Deny from all
</LIMIT>

If you have problems ...

You can ask questions in this forum.