Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to password protect a directory. I'm running Apache 2 with cPanel on Centos.

For the sake of this post, the directory is /home/user/my-secret-dir

I used cPanel's "Password Protect Directories" to create the login details, which it stored in a new /home/user/.htpasswds/my-secret-dir/passwd file.

What it didn't do is create the AuthType configuration anywhere - I could simply access the directory without prompts (it's just got a generic index.html whilst I get this working).

So I created /home/user/my-secret-dir/.htaccess myself, with the following contents:

AuthType Basic
AuthName "My Secret Directory"
AuthUserFile "/home/user/.htpasswds/my-secret-dir/passwd"
require valid-user

This now causes the browser to prompt for login details, but upon entering the correct username and password it behaves as if they were wrong and re-prompts for the details.

The details I'm entering are definitely correct.

I've previously setup a password protected directory on this same server (though for different account/domain) and that worked fine (and still works), and I've compared the two and can't see any significant differences.

Any ideas what might be causing the continual prompts, and how I can fix it?

share|improve this question
up vote 4 down vote accepted

This was a permissions issue - Apache was unable to access the auth file, so was treating everything as invalid.

Checking the logs revealed:

(13)Permission denied: Could not open password file: /home/user/.htpasswds/my-secret-dir/passwd

Turns out the /home/user/.htpasswds directory had existed before now, and had incorrect permissions on it.

I updated the permissions so Apache was able to access it, and then logging in worked as expected.

share|improve this answer
Not always permission issue, That "permission denied" message was meant for user (response that's been shown to user), the other half is about the server, and in my case it was a not found message (this was my error: [DATE] [authn_file:error] [pid 27850] (13)Permission denied: [client ip:port] AH01620: Could not open password file: /path/to/.htpasswd) It may also be a typo or a invisible character in the AuthUserFile line (which I've just encountered and took my 1.5 hours). – Arda Jan 28 at 0:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.