Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this in my .htaccess file

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$$1 [R,L]

AuthUserFile /var/www/myweb/.htpasswd
AuthGroupFile /dev/null
AuthName "Sovereign Databases"
AuthType Basic

<Limit GET>
require valid-user

But everytime I go to, the .htpasswd prompts me for a credentials BEFORE i'm redirected to After I type in my username and password, I get redirected to The problem is that I don't want anyone to submit their username and password unencrypted via http.

How do I force people to login via the https version even if they typed in the http version?

share|improve this question
up vote 5 down vote accepted

Move the Auth statements to a <VirtualHost *:443> block.

(Someone else might have a more elegant and better answer).

share|improve this answer
That's actually the most correct and elegant way to do it. – joschi May 29 '10 at 5:58
Do I have to have access to Apache config or can I use it in the .htaccess file ? – SkyHiRider Apr 14 '14 at 1:22
.htaccess applies to all VirtualHosts which access a directory, so no, it wouldn't work that way. – Chris S Apr 14 '14 at 1:45

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.