.htaccess Tutorial

.htaccess Authentication Tutorial

.htaccess is the most secure way to protect your directories from hackers or other unwanted individuals. It works by placing a '.htaccess' file in whatever directory that you would like to affect. Two files are needed to ensure that this works properly. A .htaccess file and a .htpasswd file. The .htaccess file tells the server which directories to protect and the .htpasswd file keeps all your login names and passwords securely.

Now to start off. Say you have a directory that you dont want anyone to enter or see unless they know or have login details. Lets say this directory is htpt://www.yoursite.com/password/ Creating and placing a working .htaccess into this directory would affect all other sub-directories within this folder

Here is the code for your .htaccess file, all this can be created using notepad. Save the file as ".htaccess"

AuthName "Protected Area Name"
AuthUserFile /apache/users/m/mydomain.gr/stats/.htpasswd
AuthType Basic

<Limit GET POST>
require valid-user
</Limit>

Auth name tells the server the name of the directory you would like to protect. You can change the name to anything. It does not really matter. AuthUserFile is the is your servers full path to the .htpasswd file which is where all your login details are kept. The full path is not a url. If you are unsure of your servers full path, just contact your web host.

.htpasswd file

There is no code for your .htpasswd file. Just remember that each login detail takes a new line and to type it into this format username:password One very important thing to remember is that the password you put in the .htpasswd file is coded. For example say you want to create a login for yourself using login name 'admin' and you want your password to be 'password' Simply put this line into your .htpasswd file

Sample .htpasswd file

admin:ItkroId4UAOF.

Now when the server reads your password password it encrypts and compares it with the stored encrypted password: 'ItkroId4UAOF.'. To generate your encrypted .htaccess password use the form below.

Now you're finished, save your files and upload them in ASCII mode and test it out by going to the password protected directory. You will notice now that a login prompt comes up, login and good luck.

.htpasswd generator Click on the form and this page will display your new username and password

Username:
Password: