Password-protect a folder with .htaccess

If you do not want a staging site, an admin area or a client preview to be public, basic HTTP authentication is the fastest way to protect the folder with a password.

How it works

The browser shows a user-name and password prompt for the protected folder. The server compares the input with the hashed line in the .htpasswd file. The folder's .htaccess file says which password file to use.

Two files

.htpasswd holds “user:hashed-password” per line and must sit somewhere it cannot be downloaded, outside public_html. .htaccess inside the protected folder contains the AuthType, AuthName, AuthUserFile and Require valid-user lines.

Without code in cPanel

cPanel's Directory Privacy screen sets up the same protection from the interface and writes the password file to the right place. It is the easiest way to add and manage several users.

Security notes

• Basic auth sends the password with every request; always use HTTPS.
• Choose a long, unique password; such pages attract automated guessing.
• It works as an extra layer for the WordPress admin, but blocking files such as admin-ajax.php can break plugins.

The .htpasswd generator prepares the line and .htaccess code in your browser; use the password generator for a strong password.