Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Can I use htaccess to restrict access to my site and specify the username/password within the .htaccess, so I don't have to worry about password files?

share|improve this question

You can absolutely use .htaccess to restrict access, but I don't know of any way to avoid creating an equivalent .htpasswd file if you want to control access via users and passwords, rather than whitelisted IP addresses or similar.

Now, you can create any number of .htpasswd files; so if you wanted a specific one for a specific directory, that would be easy to set up by creating the .htpasswd file using:

htpasswd /usr/local/etc/apache/.your_htpasswd_filename_here username_here

then specifying it using the "AuthUserFile" directive in your .htaccess file.

share|improve this answer

It would not be that wise to have the users and passwords inside the .htaccess file (or the apache-config itself) for min. two main reasons.

See, the .htaccess lies inside a directory of your website. The password file should never lie there, because everyone could then download it and has a complete list of valid usernames. And can brute force their passwords offline.

Another reason could be that you could have a large number of users/groups for a BASIC auth protected website. You do not want to mix server config and authentication database.

share|improve this answer
Apache should never let anyone download the .htaccess file, or you have problems. Normal httpd.conf has a directory match for all .htaccess files with deny all. How easy is it to get the .htaccess file from outside the machine? If you only need one user/password for a given path, it won't be hard to maintain. If the username is not a shell account to the machine then the web data it protects is the only risk if the .htaccess file is compromised. – Mnebuerquo Feb 10 '10 at 19:54

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.