Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am currently running into an issue with trying to password protect a directory that is sitting inside a directory that's running WordPress. This is for a directory called "admin" that handles a few things outside of WP.

In my WordPress .htaccess file, I have set a rule to ignore this directory.

RewriteEngine On
RewriteBase /
RewriteRule ^(admin|index\.php)$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /index.php [L]

When I go to my admin directory, it works just fine and I'm able to see what I should be seeing (basic PHP stuff).

However, when I try and password protect that directory by putting an .htaccess and .htpassword file in there, I get a WordPress 404 error. This is what it looks like:

AuthUserFile /home/myuser/public_html/admin/.htpasswd
AuthName "Password Protected Area"
AuthType Basic

<limit GET POST>
require valid-user

It (obviously) has something to do with the "require valid-user" line. This particular .htaccess/.htpasswd file worked just fine on a similar server set up.

Any thoughts?

share|improve this question
A 401 error, as opposed to a 404, is what you would expect to see if the require valid-user line were breaking things. Anything helpful in the Apache error log? – Shane Madden Apr 4 '11 at 18:20
It specifically says 404, not 401 (but I that's coming from WordPress). And no, I don't see anything in the error log. – Charles Chadwick Apr 4 '11 at 20:23

Try closing your browser and then trying to connect. You may have cached credentials that are being used.

If you have multiple secured directories with different passwords, use different values for the Authname.

EDIT: Try moving the Require outside the Limit statement. I always group the Auth definitions with the Require statement in the same block.

Your error seems to indicate the requested resource does not exist or is not readable. Try removing your rewrite modifications for admin. The standard rewrite rules work well with directories and files mixed into the Wordpress installation.

You may want to use a LimitExcept block instead of a Limit block to prevent access other than GET or POST. This is my working .htaccess file.

AuthType Basic
AuthName "Restricted Access"
AuthUserFile /etc/wordpress/htpasswd
Require Valid-User
<LimitExcept GET POST>
    Order allow,deny
    Deny from all

Make sure the .ht* files are readable by the web server. I test unauthorized access by changing the user id in the htpasswd file to one I haven't used.

share|improve this answer
Thanks for the response. I did try closing the browser, but no dice. I'm not even being promoted for a user or password. Also, there is only one directly secured via .htaccess. – Charles Chadwick Apr 5 '11 at 18:14
I tried your suggestions, but still no dice. I'm thinking about try to move the admin directory outside of the web root and then just setting up a subdomain. – Charles Chadwick Apr 6 '11 at 16:39
@Charles: You can point a subdomain directly at the admin directory. Have you tried without the .htaccess file. If it doesn't work without the .htaccess file then it won't work with one. On Ubuntu the WordPress software is in /usr/share, but symlinked to /var/www for the web server to access it. – BillThor Apr 6 '11 at 21:42

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.