You have a directory on your website that you do not want the whole world to see. Maybe it is an admin panel, a staging environment, or a private file repository. You could build a login system with a database and sessions, but that is overkill for a simple gate. The fastest, most reliable way to protect a directory is with HTTP Basic Authentication using .htaccess and .htpasswd.
This is one of the oldest tricks in the web server playbook, and it still works exactly the same way it did 25 years ago. Let's walk through how to set it up.
What .htaccess and .htpasswd Are
These are two separate files that work together.
The .htpasswd file is a plain text file that stores usernames and their password hashes. Each line has a username, a colon, and a hash. It looks like this:
admin:$2y$05$X9qo8uLOickgx2ZMRZoMyeIjZAgcfl7p92ldGxad68LJ editor:$apr1$R7Tb.m3.$abc123def456ghi789jkl012mno345pqr678
The hash format depends on which algorithm you used to generate it (bcrypt, APR1, SHA, or crypt). We will cover the differences in our htpasswd bcrypt vs APR1 comparison. For now, just know that the .htpasswd file is a list of users and their hashed passwords.
The .htaccess file is an Apache configuration file that lives in the directory you want to protect. It tells Apache to require authentication for that directory and points to the .htpasswd file that contains the credentials. It is a per-directory configuration override, which means you can drop it into any directory without editing the main Apache config.
Step 1: Create the .htpasswd File
The traditional way to create a .htpasswd file is with the htpasswd command-line tool that ships with Apache:
bash htpasswd -c /path/to/.htpasswd admin
This creates a new .htpasswd file (the -c flag) and adds a user named "admin." It will prompt you for a password. To add more users, drop the -c flag:
bash htpasswd /path/to/.htpasswd editor
By default, htpasswd uses bcrypt on modern systems (the -B flag forces it). On older systems, it may default to MD5 (APR1) or crypt. You can specify the algorithm:
bash htpasswd -cB /path/to/.htpasswd admin
The -B flag forces bcrypt, which is the most secure option. We cover the algorithm choices in detail in our bcrypt vs APR1 guide.
If you do not have the htpasswd command available (shared hosting, Windows, or you just do not want to use the command line), you can generate .htpasswd entries in your browser with our htpasswd generator. It produces the same format that Apache expects.
Step 2: Place the .htpasswd File Securely
This is the step people get wrong. The .htpasswd file contains password hashes. If someone can download it via HTTP, they can try to crack those hashes offline. You need to make sure it is not accessible from the web.
The safest approach is to put it outside your document root. For example, if your website files are in /var/www/html/, put the .htpasswd file in /var/www/ or /etc/apache2/. The web server can still read it (it runs as a user with access to these paths), but no HTTP request can reach it.
If you cannot put it outside the document root (some shared hosting environments do not allow it), put it inside the document root but add a rule to block access. Apache usually blocks files starting with .ht by default, but do not rely on that. Add this to your .htaccess or server config:
apache <Files ".htpasswd"> Require all denied </Files>
## Step 3: Create the .htaccess File
In the directory you want to protect, create a file named .htaccess with the following content:
apache AuthType Basic AuthName "Restricted Area" AuthUserFile /path/to/.htpasswd Require valid-user
Let's break down each line:
**AuthType Basic** — This tells Apache to use HTTP Basic Authentication. The browser will show a login dialog when the user tries to access the directory. The alternative is Digest authentication, which is more complex and rarely worth the effort.
**AuthName "Restricted Area"** — This is the realm name. It appears in the browser's login dialog and is used by the browser to group credentials. If a user authenticates for "Restricted Area" and then visits another directory with the same AuthName on the same server, the browser may reuse the credentials without prompting again.
**AuthUserFile /path/to/.htpasswd** — This is the absolute path to your .htpasswd file. It must be an absolute path, not a relative one. If you get this wrong, authentication will fail silently.
**Require valid-user** — This tells Apache that any user listed in the .htpasswd file who provides the correct password should be granted access. If you want to restrict access to specific users, you can use Require user instead:
apache Require user admin editor
This would only allow the "admin" and "editor" users, even if the .htpasswd file contains other users.
Step 4: Enable AllowOverride (If Needed)
For .htaccess files to work, Apache must be configured to allow overrides in the relevant directory. This is controlled by the AllowOverride directive in the main Apache configuration:
apache <Directory /var/www/html/private> AllowOverride AuthConfig </Directory>
AllowOverride AuthConfig allows .htaccess files to set authentication directives. If AllowOverride is set to None, .htaccess files are completely ignored. This is a common reason for .htaccess protection not working.
If you are on shared hosting, AllowOverride is usually already enabled. If you manage your own server, you may need to add it and restart Apache:
bash sudo systemctl restart apache2
For performance, some administrators disable .htaccess entirely (AllowOverride None) and put the directives directly in the server config. This avoids the overhead of checking for .htaccess files on every request. But for most setups, the convenience of .htaccess is worth the small performance cost.
Step 5: Test the Setup
Visit the protected directory in your browser. You should see a login dialog asking for a username and password. Enter the credentials you created in the .htpasswd file. If they are correct, you get access. If they are wrong, the dialog reappears.
If you are not prompted at all, the most likely cause is that AllowOverride is not enabled. If you are prompted but cannot log in, check the path to the .htpasswd file and the format of the entries.
Test with curl as well:
bash curl -I https://example.com/private/
You should get a 401 Unauthorized response with a WWW-Authenticate header. Then:
bash curl -u admin:password https://example.com/private/
This should return the protected content with a 200 status.
A Note on HTTPS
Basic authentication sends credentials as base64-encoded text in the Authorization header. Base64 is not encryption. Anyone who intercepts the request can decode the credentials instantly. This means Basic Auth must always be used over HTTPS. If you are using it over plain HTTP, your passwords are being transmitted in cleartext.
We cover this in detail in our HTTP Basic Auth security post. The short version: if your site does not have HTTPS, set it up before adding Basic Auth. There is no excuse for sending passwords in cleartext in 2026.
The Bottom Line
Password protecting a directory with .htaccess and .htpasswd is one of the simplest and most reliable security measures you can implement. It takes five minutes, it works on virtually every Apache installation, and it does not require any application code. Create the .htpasswd file, create the .htaccess file, make sure AllowOverride is enabled, and you are done.
You can generate your .htpasswd entries right now with our htpasswd generator, no command line required. And for help choosing the right algorithm, read our htpasswd bcrypt vs APR1 comparison.
