Sometimes you need to restrict access to a directory on your web server without building a full login system. In this tutorial, I will show you how to password-protect a directory in Apache using HTTP basic authentication with .htpasswd and .htaccess files. By the end, any visitor to that directory will need to enter a username and password to view the content.
Prerequisites
- A LAMP server with Apache 2.4 or later installed
- Root or sudo access to create password files
- Apache configured to allow .htaccess overrides
- A directory you want to protect
Step 1 - Install the htpasswd Utility
The htpasswd command creates and manages password files for Apache. It comes with the apache2-utils package on Ubuntu and Debian. Install it if not already present:
sudo apt update sudo apt install apache2-utils -y
On CentOS or RHEL, the package is called httpd-tools:
sudo yum install httpd-tools -y
Verify the installation:
htpasswd --help
You should see usage information for the htpasswd command.
Step 2 - Create a Password File
Choose a secure location outside your web root to store the password file. I will create it in /etc/apache2/:
sudo htpasswd -c /etc/apache2/.htpasswd admin
The -c flag creates a new file. Replace admin with your desired username. You will be prompted to enter and confirm a password. The password is hashed before being stored.
For subsequent users, omit the -c flag to avoid overwriting the file:
sudo htpasswd /etc/apache2/.htpasswd john
This adds a second user named john to the same password file.
Verify the file was created:
sudo cat /etc/apache2/.htpasswd
You will see one line per user with the username and hashed password separated by a colon.
Step 3 - Identify the Directory to Protect
Decide which directory you want to password-protect. For this example, I will protect /var/www/html/private. Create the directory if it does not exist:
sudo mkdir -p /var/www/html/private
Add a test file so you can verify protection is working:
echo "This is a protected page" | sudo tee /var/www/html/private/index.html
Before protection, this page is publicly accessible at http://your-server-ip/private/
Step 4 - Create an .htaccess File
Inside the directory you want to protect, create a file named .htaccess:
sudo nano /var/www/html/private/.htaccess
Add these directives:
AuthType Basic AuthName "Restricted Access" AuthUserFile /etc/apache2/.htpasswd Require valid-user
Here is what each line does:
- AuthType Basic specifies basic HTTP authentication
- AuthName sets the message shown in the login prompt
- AuthUserFile points to the password file you created
- Require valid-user allows any user in the password file to access the directory
Save and close the file.
Step 5 - Configure Apache to Allow .htaccess Overrides
Apache must be configured to allow .htaccess files to override authentication settings. Edit your site configuration file. For the default site on Ubuntu:
sudo nano /etc/apache2/sites-available/000-default.conf
Find the Directory block for your web root. If it does not exist, add it inside the VirtualHost block:
<Directory /var/www/html> Options Indexes FollowSymLinks AllowOverride All Require all granted </Directory>
The key line is AllowOverride All, which permits .htaccess files to override server settings. If you see AllowOverride None, change it to All.
Save and close the file.
Step 6 - Restart Apache
Test your Apache configuration for syntax errors:
sudo apache2ctl configtest
You should see Syntax OK. If you see errors, review your configuration changes.
Restart Apache to apply the changes:
sudo systemctl restart apache2
On CentOS or RHEL, use:
sudo systemctl restart httpd
Step 7 - Test the Password Protection
Open a web browser and navigate to http://your-server-ip/private/
You should see a login prompt asking for a username and password. Enter the credentials you created with htpasswd. If correct, the page loads. If incorrect, you see an authentication error.
If the page loads without a password prompt, check these common issues:
- AllowOverride is set to All in the Apache configuration
- The .htaccess file is in the correct directory
- The AuthUserFile path is correct and the file exists
- Apache was restarted after configuration changes
Step 8 - Restrict Access to Specific Users
If you only want certain users to access the directory, replace Require valid-user with Require user followed by usernames:
AuthType Basic AuthName "Restricted Access" AuthUserFile /etc/apache2/.htpasswd Require user admin
This allows only the admin user to access the directory, even if other users exist in the password file.
To allow multiple specific users:
Require user admin john
Reload Apache after changes:
sudo systemctl reload apache2
Step 9 - Secure the Password File
Ensure the password file is not accessible from the web. Since you stored it in /etc/apache2/, it is already outside the web root and safe.
Set restrictive permissions so only root and the Apache user can read it:
sudo chmod 640 /etc/apache2/.htpasswd sudo chown root:www-data /etc/apache2/.htpasswd
This prevents other users on the system from reading the password file.
Note: Basic HTTP authentication transmits credentials in base64 encoding, which is not encryption. Always use HTTPS in production to protect credentials in transit.
Step 10 - Remove a User from the Password File
To remove a user, use the -D flag:
sudo htpasswd -D /etc/apache2/.htpasswd john
This deletes the user john from the password file. No Apache restart is required.
Wrap-up
You have password-protected an Apache directory using basic HTTP authentication. This method is simple and effective for protecting staging sites, admin areas, or private content. For production use, always combine this with HTTPS to encrypt credentials in transit. If you need more advanced authentication like multi-factor or database-backed users, consider integrating Apache with an authentication provider or using application-level authentication instead.
