Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I have an Apache 2.2 VirtualHost where DocumentRoot points to /var/www/mysite.com directory. I also have Alias to make some pages/scripts located in /var/www/stuff easily available (to others VirtualHosts):

<VirtualHost *:80>
    DocumentRoot /var/www/mysite.com
    ServerName www.mysite.com
    <Directory />
        Options FollowSymLinks
        AllowOverride All
    <Directory /var/www/mysite.com/>
        Options Indexes FollowSymLinks MultiViews
        AllowOverride All
        Order allow,deny
        allow from all
    Alias /stuff /var/www/stuff

The DocumentRoot directory contains a .htaccess file (/var/www/mysite.com/.htaccess) that blocks unauthenticated accesses:

AuthType Basic
AuthName "Please say the word..."
AuthBasicProvider file
AuthUserFile /var/www/mysite.com/.htpasswd
AuthGroupFile /dev/null
Require valide-user

When I try to access http://www.mysite.com, I get the HTTP authentication form. When I try to access http://www.mysite.com/stuff, I don't get the HTTP authentication form: files are freely accessible.

It seems the /var/www/mysite.com/.htaccess is skipped when accessing http://www.mysite.com/stuff because files are in /var/www/stuff id. not under /var/www/mysite.com/.htaccess's parent directory.

The only workaround I've found is to create a /var/www/stuff/.htaccess symlink to /var/www/default/.htaccess :

user@server:~$ ln -s /var/www/default/.htaccess /var/www/stuff/.htaccess

Is there any better/cleaner solution?

share|improve this question

1 Answer 1

It would work as you want it to if /var/www/stuff was actually /var/www/mysite.com/stuff and you removed the Alias. As it is currently, 'stuff' is NOT inside the DocumentRoot, why on Earth would Apache be looking completely elsewhere for the .htaccess file?

share|improve this answer
Indeed, stuff directory is not inside DocumentRoot on a filesystem point of view, but it is regarding to the URL it is accessed by (mysite.com/stuff). Regarding to that, the .htaccess is not actually completely elsewhere. –  CDuv Jul 19 '13 at 13:48

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.