I'm trying to work out how to protect a folder in Apache 2.4.

I have this part working fine:

AuthUserFile   /home/test/web/site.com/cgi-bin/hotels/admin/.htpasswd
AuthGroupFile  /dev/null
AuthType       Basic
AuthName       Protected

require valid-user

...but I also want to add the option of allowing me in without having to login. This is what I had on my old server:

Order Deny,Allow
Deny from all
Allow from
Satisfy Any

but the new one gives an error:

client denied by server configuration: /home/test/web/site.com/cgi-bin/hotels/admin/admin.cgi

Looking at https://wiki.apache.org/httpd/ClientDeniedByServerConfiguration , I would have assumed this would work:

Require all denied
Allow from
Satisfy Any

...but it doesn't seem to (doesn't even ask for a login now, even when I change the accepted IP to a random one)

What am I missing?

1 Answer 1


Do not mix 2.2 and 2.4 directives like that. Satisfy/Order/Allow/Deny are all 2.2.x

Use 2.4 only and unload mod_access_compat:

AuthType Basic
AuthName "Authorized Users Only"
AuthBasicProvider file
AuthUserFile /home/test/web/site.com/cgi-bin/hotels/admin/.htpasswd
Require valid-user
Require ip

Note: htaccess has nothing to do with directory protection, if you have access to the main configuration files of the apache httpd server, define these all inside a <Directory /filesystem/path/to/protected/dir> tag

Note2: Forgot to mention, RequireAny has been specified for example purposes, but that is the default behaviour in 2.4.x so you do not really need to specify it if you don't want.

  • 1
    Thanks - that looks like it did the job. Unfortunately I can't put it in the main .conf file, as it would get overwritten by the VestaCP system when you make changes to the domain Apr 20, 2017 at 15:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.