Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have a site with a virtual directory structure like mysite.com/folder/title which is actually a .htaccess rewrite to mysite.com/f/index.php?p=title. I want to password protect the folder folder with .htaccess, and know how to do that with actual folders. But I don't want to password protect the main site mysite.com, and right now if I put the .htaccess file in the mysite.com directory, I am protecting mysite.com and mysite.com/folder. I have also tried protecting mysite.com/f.

How can I protect only mysite.com/folder using .htaccess?

.htaccess contents of mysite.com.

<IfModule mod_rewrite.c>
RewriteEngine On

RewriteRule ^folder/(.*)$ /f/index.php?p=$1 [PT,L,QSA]
RewriteRule ^folder/*$ /f/index.php [L,QSA]

RewriteBase /
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]


.htaccess file I tried in mysite.com/f This successfully protects the entire site when moved into the other .htaccess file, so I know the path is correct.

AuthName "Restricted Area" 
AuthType Basic 
AuthUserFile /home/myusername/.htpasswd 
share|improve this question
I just plugged your question title into Google and found many articles that answer it far better than I ever could. –  John Gardeniers Sep 8 '10 at 21:47
Hi, thanks. I've also done that and read those articles. Unfortunately, none of those answer the question, and the only question that asks the same thing as me is left unanswered. If you have found the answer, could you possibly post the link here? –  jkeesh Sep 13 '10 at 4:57

1 Answer 1

First of all you shouldn't be putting that configuration (the rewrite rules) in .htaccess files, you should be putting it in the main configuration file under a Directory section (assuming you have access to that file). The Apache docs explain why.

You should check that you have the correct AllowOverride settings. If it's all setup correctly, having the .htaccess file you specified sitting in the mysite/f folder should be enough to password protect it.

share|improve this answer
I would but I don't have access to those files. Do you know if there is a workaround just using .htaccess? –  jkeesh Sep 13 '10 at 4:58

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.