Creating the password file
The first step is to create a simple text file that will store your username and password, separated by a colon (:). The small catch is that the password must be encrypted. Luckily, there are many free web-based utilities that will encrypt the password for you. Try one of these:
- 4WebHelp’s online .htpasswd encryption tool
- Alterlinks .htaccess password generator
- htmlite’s htpasswd encryption page
Simply enter your desired username and password in one of these pages and submit the form. You’ll get back a string similar to the following:
fred:p29cmnwl4a0et
Now, open up your favourite text editor (e.g. Notepad or TextEdit), then copy and paste the username/password string into the editor. Save the file and call it .htpasswd.
Next, upload this file to your website. Make sure you place it outside the Web root of your site if possible, as you don’t want just anyone to be able to view the file! For example, place it above your public_html or htdocs folder. (Having said this, Apache is often set up by default to block web-based access to files beginning with .ht. Better safe than sorry though!)
If you can’t place your .htpasswd file outside your Web root, name it something that’s not easily guessable – for example, .htxuymwp – so that people won’t be able to find it easily. (In addition, it helps to start the filename with.ht; as mentioned earlier, Apache usually blocks access to files starting with .ht.)
Alternative: Creating the password file using htpasswd
If you have SSH access to your web server (or you’re running Apache on a local machine), you can encrypt your password and add it to your password file in one go by using the htpasswd utility that comes with Apache. Simply SSH to your server or open up a terminal window on your local machine, cd to the folder where you want to create your password file, and type:
htpasswd -c .htpasswd fred
(where fred is the username you want to use). You’ll be prompted to enter and retype your password, then the.htpasswd file will be created for you.
Creating the .htaccess file
Now that you have created and uploaded your password file, you need to tell Apache to use it to protect your page(s) or site. This is what your .htaccess file will do.
Open your text editor again, create a new file, and save it as .htaccess.
Protecting a folder
To password protect a folder on your site, you need to put the following code in your .htaccess file:
AuthUserFile /full/path/to/.htpasswd
AuthType Basic
AuthName "My Secret Folder"
Require valid-user
/full/path/to/.htpasswd should be the full path to the .htpasswd file that you uploaded earlier. The full path is the path to the file from the Web server’s volume root – for example, /home/username/.htpasswd orC:\wwwroot\username\.htpasswd. (If you’re not sure of the full path to your site or home directory, ask your Web hosting company for this info.)
The above .htaccess file will password protect all files in the folder that it is placed in, and all sub-folders under that folder too. So if you wanted to password protect your entire site, you would place the .htaccess file in your Web root folder.
Protecting a file
To password protect just a single file in a folder, use the following .htaccess file:
AuthUserFile /full/path/to/.htpasswd
AuthType Basic
AuthName "My Secret Page"
<Files "mypage.html">
Require valid-user
</Files>
This will password protect just the mypage.html file in the folder where you put the .htaccess file.