This is probably a simple problem, but I cant find the solution in the documentation.

I want to password protect my website using BASIC authentication. But I want a subdirectory to be non protected :

http://mysite.com/ -> BASIC protected
http://mysite.com/somedir -> BASIC protected
http://mysite.com/someotherdir -> BASIC protected
http://mysite.com/public -> not protected

I have no problem protecting all the site, but I dont know how I can "unprotect" one directory. The site is hosted on a shared host, so I only have access to .htaccess files to do the configuration.

Is there a directive to negate the authentication ?

Thanks for the help ...


Shouldn't be a problem with .htaccess, depending on what the host has allowed.

You could try putting a .htaccess in the sub-folder with the following, although overrides will have to be enabled for the directories it's in.

 Allow From All
 Satisfy Any
  • 1
    The secret sauce here, IIRC, is to put the .htaccess at the root of your site, but have an entry in that .htaccess file like the one Cylindric talks about. – Paul Lathrop Jul 27 '09 at 16:39
  • And don't forget to add (or make sure there exists) an AllowOverride so the .htaccess will be used. – TCampbell Jul 27 '09 at 17:13
  • 1
    @Paul - I've deleted my answer, but AFAICR Cylindric's answer is currently wrong? A .htaccess file in a subdirectory cannot override one higher up. However the .htaccess file in the parent directory can also include controls (or indeed remove them) for subdirectories. – Alnitak Jul 27 '09 at 17:27
  • I tried both putting a <Directory/> directive in the root folder and in the folder I want to be public, but in both cases I get an HTTP 500. Any other ideas ? – Guillaume Jul 27 '09 at 20:47
  • 1
    You can't use <Directory> in .htaccess, although you can use <Files> and <Location> – Alnitak Jul 27 '09 at 21:50

OK, for a path server.com/private/public:


AuthType Basic
AuthName "Private, keep out."


Allow From All
Satisfy Any

The key here is 'Satisfy Any' which ORs the requirements from upstream together. 'Satisfy All' is the default.


I believe this might do it:

# put the global auth stuff here

# put the override here
<Location /public>
Allow from All
Satisfy Any
  • It's never a good idea to use <Location>s for access control. It only controls access via a name, rather than the resource itself. Thus, anything that provides access to it via a different name (Alias, for example) has no access control applied to it. – CK. Jul 29 '09 at 13:09
  • 1
    @CK Actually you must use Location if the location in question is not a physical directory but merely an "virtual" directory in disguise by something like mod_rewrite. – Natalie Adams Nov 6 '10 at 17:00

I managed to solve this doing this:

<Directory "/path/to/maindirectory">
[... auth stuff ... ]

<Directory "/path/to/mysubdirectory">
 Allow from All
 Satisfy Any

Do NOT use Locations, because they're made to be case sensitive and they do not act on actual folder access, but just over the URL.

So, for instance, if I write






it's different for Location control, even if the physical directory called is the same!!!

In short, you check access for directory "stuff" and I can get in writing it with different case.

Also, using .htaccess file in single directory with location control on others did not work to me.

Hope it helps.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.