To protect one folder, add auth_basic and auth_basic_user_file to the NGINX location that serves its URL, create the credentials file with htpasswd, test the configuration, and reload NGINX. Keep that file outside the public document root, ensure the NGINX worker can read it, and use HTTPS because HTTP Basic Authentication only base64-encodes credentials.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
What NGINX Basic Auth protects
NGINX Basic Authentication limits access to a URL location by checking the username and password supplied by the client against a flat password file. The protection follows the URL path selected by the NGINX configuration, not a folder name on disk by itself. For example, a location serving /private/ can require credentials while the rest of the site remains public.
As an Amazon Associate I earn from qualifying purchases.
The two directives that perform the check are:
auth_basicenables Basic Authentication and sets the realm displayed in the login prompt.auth_basic_user_filepoints to the file containing the usernames and password hashes.
Both directives can be placed in a location block for narrow protection or at server level when the default should be protected more broadly. A nested public location can cancel inherited authentication with auth_basic off.
Before you start
Identify the URL and the filesystem directory
Decide which URL should require a login, such as https://example.com/private/, and confirm which NGINX location serves it. The URL prefix and the filesystem path are related by directives such as root; they are not interchangeable. The example below maps /private/ beneath /var/www/html, but your installation may use a different document root or a different server block.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Use an HTTPS virtual host
Basic Authentication sends a user ID and password in a base64-encoded form. Base64 is an encoding, not encryption, so anyone able to observe an unencrypted connection could recover the credentials. Configure TLS and direct users to the HTTPS URL before enabling this login.
Plan a private password-file location
Store the credentials file outside the public document root whenever possible. A path such as /etc/nginx/.htpasswd prevents an ordinary web request from mapping directly to the file. NGINX workers still need filesystem read access, so choose a directory that the worker account is allowed to read.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsInstall htpasswd
The htpasswd utility creates and updates the flat file used by NGINX. Install the package appropriate to the operating system:
| Operating-system family | Package providing htpasswd |
|---|---|
| Debian or Ubuntu | apache2-utils |
| RHEL, CentOS, or Oracle Linux | httpd-tools |
Package names and installation commands can differ when NGINX was installed through a vendor image, container, or another distribution. Install the package through your system’s normal package manager, then verify that the htpasswd command is available before editing NGINX.
Create the password file correctly
Create the first account
Run this command as an administrator, replacing the path if your NGINX installation uses another protected directory:
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
sudo htpasswd -c /etc/nginx/.htpasswd aliceYou will be prompted for Alice’s password. The -c option creates a new file. Use it only for the first account: running it again against an existing file recreates the file and can remove accounts already stored there.
Recommended Free Tools
Add another account
To add Bob without recreating the file, omit -c:
sudo htpasswd /etc/nginx/.htpasswd bobRepeat the same form for additional users. The file contains usernames and password representations that NGINX can validate; it does not need to be placed under the website’s document root.
Check ownership and permissions
The NGINX worker processes open the password file when authenticating requests. If the workers cannot read it, authenticated requests fail even when the username and password are correct. Check the file’s owner, group, and mode according to the worker account used by your installation, and make sure every parent directory permits traversal by that account.
Do not solve a read-permission problem by making the file publicly writable or world-readable. Grant the minimum read access required by the worker, and keep administrative write access restricted to the accounts that manage credentials.
Protect one folder with a location block
Place the authentication directives in the server block that handles the HTTPS site. This example protects URLs beginning with /private/ and leaves locations without those directives unaffected:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
server {
listen 443 ssl;
server_name example.com;
location /private/ {
root /var/www/html;
auth_basic "Private files";
auth_basic_user_file /etc/nginx/.htpasswd;
}
}In this configuration, a request for a resource beneath /private/ is challenged, and the realm shown to the user is Private files. Substitute your actual hostname, TLS configuration, document root, URL prefix, and password-file path. The exact server-block filename and default directory depend on how NGINX was installed.
What happens on a request
- A client requests a URL that matches the protected location.
- NGINX checks for valid Basic Authentication credentials in the configured password file.
- If credentials are absent or do not match, NGINX returns HTTP status
401(Authorization Required) and the client normally displays a login prompt. - If the credentials match, NGINX continues processing the request and serves the resource subject to the rest of the configuration.
Authentication does not change the underlying file mapping. Access controls, index handling, aliases, proxying, and other directives still apply to the location.
Protect most of a site and leave a path public
If the desired policy is “private by default,” set authentication at server level and explicitly disable it for a public nested location:
server {
auth_basic "Private site";
auth_basic_user_file /etc/nginx/.htpasswd;
location /public/ {
auth_basic off;
}
}NGINX inherits the server-level settings into locations unless a nested configuration overrides them. auth_basic off cancels the inherited setting for /public/; it does not delete the password file or affect other locations. Use this pattern when a site has a protected default and only a small, clearly defined set of public paths.
Choose the right scope and credential model
| Configuration choice | Scope | Credential storage | Operational profile |
|---|---|---|---|
Authentication inside one location |
Only the matching URL path, such as /private/ |
Flat file created and maintained with htpasswd |
Simple for a folder or a small set of users |
Authentication at server level with public overrides |
The server by default, with selected nested locations made public using auth_basic off |
Flat file created and maintained with htpasswd |
Useful when most content is private and exceptions are easy to enumerate |
A flat file is convenient for a small, locally managed user list. A larger organization may require a centralized identity system, but that is a different access-control design rather than a change to the two Basic Auth directives shown here.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Test and reload without taking the site down
- Save the edited server configuration.
- Run the syntax and configuration test:
sudo nginx -t - Fix every reported error before applying the change. Common causes include a misspelled directive, an unmatched brace, or an incorrect absolute path to the password file.
- Reload NGINX after a successful test:
sudo systemctl reload nginx - Request the protected URL in a browser or another HTTP client. Confirm that it asks for credentials, rejects an incorrect password with
401, and serves the resource after a valid login.
The service-manager command can vary with the operating system or installation method. Use the service-control mechanism provided by your installation if it is not managed by systemd.
Troubleshoot the common failure modes
Every protected request returns 401
A persistent 401 generally means the supplied username and password do not match an entry in the configured file, or the client has not sent credentials. Confirm the username spelling, reset the account with htpasswd, and retry in a fresh browser session. If several accounts fail at once, check the configured file path and permissions rather than changing each password blindly.
NGINX cannot read the password file
Verify the exact absolute path in auth_basic_user_file, then inspect permissions on the file and every parent directory. The worker account must be able to open the file for reading. A file that exists but is inaccessible to workers has the same practical result as a missing file: authenticated requests fail.
Free tools Windows power users keep installed
One-click scans. No signup required.
The password file is exposed as a download
Move it outside the public document root, such as /etc/nginx/.htpasswd, and update the directive to the new absolute path. Do not rely on a leading dot in the filename as the security boundary; the important controls are filesystem placement, permissions, and the NGINX configuration.
The public exception still asks for a password
Check that the request actually matches the nested public location and that the override is written as auth_basic off;. If authentication is defined at server level, the nested location must cancel inheritance explicitly. Also verify that another more-specific location is not handling the request.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
The configuration test fails after an edit
Run sudo nginx -t again and read the reported filename and line number. Correct syntax, braces, directive spelling, and paths before reloading. Never skip the test and reload a configuration that has not passed validation.
Adding a user removes existing users
This happens when -c is used for an existing file. Use sudo htpasswd /etc/nginx/.htpasswd username without -c to add or update one account while retaining the others.
Password-file formats and hashing cautions
The NGINX Basic Auth module supports password entries using traditional crypt, Apache’s apr1, and RFC 2307 forms. NGINX warns against using unsalted SHA-1 entries marked {SHA} for new passwords. Let the installed htpasswd utility create the entry instead of hand-editing hash formats, and treat the file as sensitive even though it does not contain the original plaintext passwords.
Changing a password-file hash does not provide transport security. TLS remains necessary because the username and password travel through the HTTP Basic Authentication exchange in base64 form.
Security checklist
- Serve the protected URL over HTTPS/TLS, not cleartext HTTP.
- Keep the password file outside the public document root whenever possible.
- Use an absolute path in
auth_basic_user_file. - Confirm that the NGINX worker account can read the file and traverse its parent directories.
- Use
-conly when creating a new password file. - Use
auth_basic offdeliberately when a nested public location must override server-level authentication. - Run
nginx -tbefore every reload. - Test both failure and success: an incorrect login should produce
401, while a valid login should reach the protected resource.
When this approach is a good fit
NGINX Basic Auth is a practical boundary for a private folder, a small internal site, or a limited group of users when a flat credentials file is acceptable. Its configuration is short, the protected scope is explicit, and user entries can be added with one command.
It is not a substitute for HTTPS, nor does it provide centralized identity management, role-based permissions, multifactor authentication, or application-level authorization. If those controls are required, use an identity system designed for them and treat NGINX Basic Auth as a separate, simpler gate rather than expanding the flat-file pattern indefinitely.
Complete example
The following sequence creates one account, protects a folder, validates the configuration, and reloads NGINX:
# Debian or Ubuntu: install apache2-utils
# RHEL, CentOS, or Oracle Linux: install httpd-tools
sudo htpasswd -c /etc/nginx/.htpasswd alice
# In the HTTPS server block:
# location /private/ {
# root /var/www/html;
# auth_basic "Private files";
# auth_basic_user_file /etc/nginx/.htpasswd;
# }
sudo nginx -t
sudo systemctl reload nginxAfter the reload, open the HTTPS URL beneath /private/. A credential prompt confirms that the location is protected; a valid entry in /etc/nginx/.htpasswd allows the request to proceed.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
