I have a website i'm hosting in Apache (on Windows), and i'd like to protect it so that anyone going in needs to enter a password. This is not meant to be a fortress of security, I know this sucks, but it's better than nothing, and I don't want to go through any of the alternatives that'll make it more secure (they're truly not worth it for this).

What i'd like is for the typical HTTP authentication dialog to pop up asking the visitor for a password. Everyone will have the same password. In fact, if I can have the username be blank, that'd be ideal. If not, everyone will have the same username.

Could you let me know how I can do this? All tutorials I've found were for more advanced use cases, where the actual users/passwords of the machine were used.
Is it possible to just set this to a hardcoded password in a file? Or do I need to create a Windows user?


Google for:

Apache htpasswd basic auth


  1. Create htpasswd file. This file can be called anything, and should be outside your DocumentRoot. Use htpasswd utility for this

    touch /etc/http.passwd
    htpasswd /etc/http.passwd jsilverman
    New password: 
    Re-type new password: 
    Adding password for user jsilverman
  2. Add the following to your Apache config, in either (a) your main apache2.conf (more centralized, arguably more manageable) or (b) an .htaccess file in the protected dir (easier, more direct, no apache restart required)

    AuthType Basic
    AuthName "Password Protected Area"
    AuthUserFile /etc/http.passwd
    Require user jsilverman
  3. Reload Apache if you did (a), otherwise you are done.

If this happens: htpasswd: command not found

You may need to install apache2-utils or a similar package.

However, I don't really think you searched very hard. There is nothing if not 10s of thousands of examples of this process on the WWW, dating back to the mid '90s. But I'm feeling chatty, so you got a real answer instead of a smartass RTFM. But really, RTFM -- the Apache web server is one of the best documented pieces of open source software, period.

Update: Wow, you really didn't search very well. I just did an "I feel lucky" Google search for "password protect website" and got basically this answer.

  • 2
    Since he was asking for help on the Windows platform, your answer seems to miss that part. For anyone search for a htpasswd version for Windows; you might as well use an online tool for that. – Uwe Keim Jun 10 '14 at 12:46
  • Not working for me. Tried to add to conf and got "AuthUserFile not allowed here" – dermoritz Aug 9 '16 at 14:36

Yes, you can do this via .htaccess files or your httpd.conf.

Here's a generator to build the username/password file: http://tools.dynamicdrive.com/password/
And here's the Apache documentation on it: http://httpd.apache.org/docs/2.0/howto/auth.html

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.