Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In the document root of my web server (Apache 2.2.15 on CentOS 6.0) I have an /index.php script, which I'd like to be password protected and then few helper scripts (/helper1.php, /helper2.php, ...) which actually shouldn't be password-protected - because they are sometimes used directly (for example "hotlinked" from some Excel spreadsheets).

At the moment I have every script password-protected:

<Location />
        AuthType basic
        AuthName "My Protected Area"
        Require valid-user

        AuthBasicProvider ldap
        AuthzLDAPAuthoritative  Off
        AuthLDAPURL             "ldap://,DC=XXX,DC=com?sAMAccountName?sub?(objectClass=user)"
        AuthLDAPBindPassword    XXXXXX

Can anyone please suggest me a way, how to keep /index.php password-protected, but at the same time do not require entering a password when using /helper1.php, etc.?

Thank you! Alex

share|improve this question
up vote 0 down vote accepted

For any php script you don't want to protect, put a Satisfy Any in Location directive. You can also use LocationMatch, something like this:

<LocationMatch "/helper(1|2).php">
    Satisfy Any
share|improve this answer
No this will not protect '/' . You need a seperate one for '/' and '/index.php'. Or one combined with regexp. – cstamas Sep 22 '11 at 9:47
No, I get authentication error immediately – Alexander Farber Sep 22 '11 at 9:50
Sorry, please check out my updated answer. – quanta Sep 22 '11 at 10:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.