Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this in my virtual host:

<LocationMatch "/pressonly">
     AuthType Basic
     AuthName "Press Only"
     AuthUserFile /home/pur/.htpasswd
     Require valid-user

It shows the login fine, but if I press cancel, I still get the page, what am I missing / doing wrong?


I think, after some more research I have found out that my Location / LocationMatch must go after any rewriting is performed. Therefore my vhost should be:

RewriteEngine On
RewriteCond %{REQUEST_FILENAME} -s [OR]
RewriteCond %{REQUEST_FILENAME} -l [OR]
RewriteCond %{REQUEST_FILENAME} -d
RewriteRule ^.*$ - [NC,L]
RewriteRule ^.*$ /index.php [NC,L]
<Location /pressonly>
     AuthType Basic
     AuthName "Press Only"
     AuthUserFile /home/pur/.htpasswd
     Require valid-user

And I should not have a .htaccess file. However, using the above doesn't perform any rewriting.

share|improve this question
Is there a Satisfy directive elsewhere in your config? – Shane Madden Nov 2 '11 at 19:06
@ShaneMadden no I don't think so, not in the vhost or htaccess although it could be somewhere in the defaults? Any way I can check? – Ashley Nov 2 '11 at 19:08
Are you 100% sure you are still getting the page as opposed to just a caching issue from before the directory was protected? Have you tried on a freshly started browser? – Pekka 웃 Nov 2 '11 at 20:24
@Pekka yep, I have cleared my cache in chrome, ff and IE but still happens – Ashley Nov 2 '11 at 20:34
Are there any ErrorDocument 401 directives in the Apache config? – Sergey Vlasov Nov 5 '11 at 14:31
up vote 4 down vote accepted

Add the order deny, allow statements as well as deny from all. You'll also need a satisfy directive as well. I suspect your default allow is kicking in after you cancel the authentication.

<Location /pressonly>
    AuthType Basic
    AuthName "Press Only"
    AuthUserFile /home/pur/.htpasswd
    Require valid-user
    order allow,deny
    deny from all
    Satisfy any

Update: there shouldn't be a space between allow and deny.

share|improve this answer
With those apache won't start – Ashley Nov 5 '11 at 10:34
Thanks for the update, but still going through to the page. Will look for Satisfy entries now – Ashley Nov 9 '11 at 21:27
I ended up getting my host admin to fix it for me. I'm not sure what they did but I know they added the ErrorDocument as @sergey vlasov said. However, seeing as you're the only one who answered - you get the bounty :) – Ashley Nov 10 '11 at 8:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.