I added .htaccess
AuthType Basic AuthName "restricted area" AuthUserFile /path/to/the/directory/you/are/protecting/.htpasswd require valid-user
However, it is not working. It doesn't prompt me for login.
Your .htaccess file looks fine. The only reason it is not working as you have it is that Apache is configured to ignore it.
In your apache config, ideally in the sites-* config file, add:
The AllowOverride directive is what allows the htaccess file to function. By default, most Apache setups have it turned off (set to None actually), including Ubuntu/Debian.
In your .htpasswd file, the password must be encrypted. You can do this most easily using the htpasswd tool that mezgani suggested. It will look like this if you read the file:
With the AllowOverride directive set to at least AuthConfig, your .htaccess file in place, and your .htpasswd containing a user with an encrypted password, you should be good to go.
First, add this following to your apache config:
After, you may create the .htpasswd file that will contain your login and password with htpasswd command and not manually
I think that moving the .htpasswd file somewhere different from the path of the directory that you are protecting is more secure.
Also, For security reasons, please read this article on securityfocus
In Snow Leopard (OS X 10.6), changing the AllowOverride in httpd.conf only enables .htaccess protection in the main web pages (/Library/WebServer by default). Enabling it for individual users' ~/Sites folders is controlled by a separate .conf file for each user. On my systems this is under /etc/apache/users . Jeff Snider's reference to "in the sites-*" may be where the files for individual users' pages are configured on his system.