Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I added .htaccess

AuthType Basic
AuthName "restricted area"
AuthUserFile /path/to/the/directory/you/are/protecting/.htpasswd
require valid-user

and .htpasswd


However, it is not working. It doesn't prompt me for login.

share|improve this question

Your .htaccess file looks fine. The only reason it is not working as you have it is that Apache is configured to ignore it.

In your apache config, ideally in the sites-* config file, add:

<Directory /path/to/the/directory/you/are/protecting/>
      AllowOverride AuthConfig

The AllowOverride directive is what allows the htaccess file to function. By default, most Apache setups have it turned off (set to None actually), including Ubuntu/Debian.

In your .htpasswd file, the password must be encrypted. You can do this most easily using the htpasswd tool that mezgani suggested. It will look like this if you read the file:


With the AllowOverride directive set to at least AuthConfig, your .htaccess file in place, and your .htpasswd containing a user with an encrypted password, you should be good to go.

share|improve this answer

First, add this following to your apache config:

<Directory /path/to/the/directory/you/are/protecting/>
        AllowOverride AuthConfig
        Options Indexes MultiViews FollowSymLinks
        deny from all
        Order deny,allow

After, you may create the .htpasswd file that will contain your login and password with htpasswd command and not manually

htpasswd -c /path/to/the/directory/you/are/protecting/.htpasswd username
I think that moving the .htpasswd file somewhere different from the path of the directory that you are protecting is more secure.

Also, For security reasons, please read this article on securityfocus

share|improve this answer
how do you remove it later ? – jaaaaaaax Oct 15 '09 at 20:22
Delete the .htaccess and .htpasswd files. and don't forget to remove the apache config that you've added – mezgani Oct 15 '09 at 20:27
it doesn't work. – jaaaaaaax Oct 15 '09 at 20:50
You will need to add a require valid-user below the Order line. The current apache configuration is set to deny from everyone. – emills Oct 15 '09 at 21:11
yes. i did that. still doesn't work. – jaaaaaaax Oct 15 '09 at 21:18

In Snow Leopard (OS X 10.6), changing the AllowOverride in httpd.conf only enables .htaccess protection in the main web pages (/Library/WebServer by default). Enabling it for individual users' ~/Sites folders is controlled by a separate .conf file for each user. On my systems this is under /etc/apache/users . Jeff Snider's reference to "in the sites-*" may be where the files for individual users' pages are configured on his system.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.