To password-protect an Apache directory on Ubuntu, install the apache2-utils package, create an .htpasswd credential file outside the web root, and add Apache Basic Authentication directives for the protected directory. You can place those directives in a virtual-host or <Directory> block (the preferred administrative method), or in a per-directory .htaccess file when the matching directory allows AuthConfig overrides.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
After checking the configuration with apache2ctl configtest, reload Apache and test for a 401 challenge before checking that valid credentials return the protected resource. Basic Authentication must be used over HTTPS: Apache’s documentation warns that “Basic authentication sends the password from the client to the server unencrypted.”
As an Amazon Associate I earn from qualifying purchases.
What Apache Basic Authentication protects
Apache Basic Authentication places an HTTP login challenge in front of a URL path. A client that has no credentials receives a 401 Unauthorized response and a browser login prompt. A client that supplies an account from the configured password file can continue to the resource. The protection applies to the URL directory selected by your Apache configuration, such as /private/ mapped to /var/www/html/private.
Authentication has two required parts:
- A flat credential file containing the users and password records managed by
htpasswd. - Apache authentication and authorization directives that point to that file and decide which users may enter.
The password file is not a web page and should never be reachable through a browser. Keep it outside both the document root and Apache’s URI space. A path such as /etc/apache2/.htpasswd is suitable because it is separate from /var/www/html.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Basic Authentication is an identity check, not encryption. Without TLS, the password is sent in a form that can be intercepted on the network. Configure a valid HTTPS/TLS virtual host before using this method for private game assets, administration panels, staging sites, or any other sensitive content.
Plan the protection before editing Apache
Decide which filesystem directory and URL should be protected before writing directives. For example, if Apache serves /var/www/html/private at https://example.com/private/, the <Directory> block must name the filesystem path, while your tests must request the corresponding URL. A block for a different directory can be syntactically correct yet leave the requested path unprotected.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchAlso decide whether every account in the file should be accepted or whether access belongs to one named user. Require valid-user is the broad rule; Require user alice narrows authorization to Alice. This choice affects testing: a valid Bob login should work with the first rule but be denied with the second.
Finally, choose where the directives will live. Central virtual-host or <Directory> configuration is normally easier for an administrator to audit and deploy. A directory’s .htaccess is appropriate when per-directory delegation is required, but it only works when the enclosing configuration allows authentication overrides.
Install the htpasswd utility
Ubuntu packages the htpasswd command in apache2-utils. Install it from an administrative shell:
sudo apt update
sudo apt install apache2-utilsThe package supplies the utility used to create and maintain the flat files consumed by HTTP Basic Authentication. Installing it does not itself enable protection on any URL; you still need to create a credential file and configure Apache.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Create the credential file safely
Create the first account
Create the file in a location that is not under the site’s document root. The -c option creates a new file:
sudo htpasswd -c /etc/apache2/.htpasswd aliceEnter the password when prompted. The command writes an account named alice to /etc/apache2/.htpasswd. Use an absolute path in Apache so the server does not depend on a working directory or a relative path.
Add more accounts without replacing the file
When the file already exists, omit -c:
sudo htpasswd /etc/apache2/.htpasswd bobThis adds bob while preserving the existing entries. Running htpasswd -c again against the same path creates a new file and can replace the existing credential list, so use that option only for the initial creation (or when you deliberately intend to rebuild the file).
Repeat the no--c form for each additional account. Keep a record of which accounts should be authorized by the Apache Require rule; creating an account does not grant it access when a user-specific requirement names someone else.
Recommended Free Tools
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Protect the file on disk
Keep the file outside /var/www/html and any other directory Apache serves directly. Set ownership and permissions so only the administrators who maintain accounts and the Apache process that must read the file can access it. Do not solve a read-permission error by making the file broadly readable without considering the exposure of every password record.
If you ever discover that the file is downloadable or otherwise web-visible, move it out of the document root and URI space immediately, then change the affected credentials. Update AuthUserFile to the new absolute path, validate the configuration, and reload Apache before testing again.
Configure a protected directory in Apache
Preferred method: a virtual-host or <Directory> block
Put the authentication rules in the active virtual-host configuration or in a matching <Directory> block. For a directory at /var/www/html/private, the essential configuration is:
<Directory "/var/www/html/private">
AuthType Basic
AuthName "Restricted area"
AuthBasicProvider file
AuthUserFile "/etc/apache2/.htpasswd"
Require valid-user
</Directory>Each directive has a distinct job:
AuthType Basicselects HTTP Basic Authentication.AuthNamesets the authentication realm displayed by clients. The text in the example appears asRestricted area.AuthBasicProvider filetells Apache to use a flat file provider. Apache documentsfileas the default provider, so this line is optional when the file provider is intended, but leaving it explicit makes the configuration easier to audit.AuthUserFilegives Apache the absolute filesystem path to the credential file.Require valid-userallows any username that successfully authenticates against that file.
To permit only one account, replace the final rule with a user-specific requirement:
Require user aliceThe directory path in the block must correspond to the filesystem location Apache serves for the requested URL. A block for the wrong directory will not protect the path you are testing.
Why the directory block is usually preferable
Central configuration keeps access rules under administrator control, makes the protected path visible in one place, and avoids relying on every deployed directory containing a correctly written .htaccess. Changes are made in the server configuration and then applied with an Apache reload. This approach also avoids granting applications or content authors permission to change authentication behavior through files inside the document tree.
Centralizing the rules also makes it easier to compare the authentication policy with the virtual host serving the site. When several sites or hosts are configured, verify that the block is in the active host rather than a similarly named but unused configuration. Always test through the same hostname and URL that real users will request.
Use .htaccess when per-directory delegation is required
Create the authentication file
If you need the rules to travel with a particular directory, create /var/www/html/private/.htaccess containing the same directives:
The Tool Desk
Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →AuthType Basic
AuthName "Restricted area"
AuthBasicProvider file
AuthUserFile "/etc/apache2/.htpasswd"
Require valid-userThe credential file remains outside the web root. Only the directives move into .htaccess. Ensure the file is in the directory that maps to the requested URL and is named exactly .htaccess, including the leading dot.
Allow authentication overrides
Apache reads authentication directives in .htaccess only when the enclosing server configuration permits them. Add an appropriate block to the active Apache configuration:
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
<Directory "/var/www/html/private">
AllowOverride AuthConfig
</Directory>AllowOverride AuthConfig enables authentication-related directives in .htaccess. Without it, Apache may ignore or reject AuthType, AuthName, AuthBasicProvider, AuthUserFile, or Require in that file. The <Directory> path must match the directory containing the .htaccess file and the URL you are requesting.
After adding or changing the override block, run a syntax check and reload Apache. A later edit to the delegated file is still dependent on that matching directory policy; moving the directory or changing the virtual host can make a previously effective file appear to stop working.
Directory configuration versus .htaccess
| Decision point | Virtual host or <Directory> |
.htaccess |
|---|---|---|
| Administration | Central server administration | Per-directory delegation |
| Authentication directives | Written directly in the active Apache configuration | Written in the directory’s .htaccess |
| Override requirement | Does not depend on AllowOverride AuthConfig |
Requires AllowOverride AuthConfig or an appropriately broader override in the matching block |
| Applying changes | Validate and reload Apache after editing the server configuration | Enable the override in server configuration, then reload Apache; subsequent per-directory edits are read through that mechanism |
| Operational risk | Rules remain centralized, reducing accidental per-directory syntax or exposure mistakes | Delegated files can be overlooked, misnamed, or ineffective when overrides are not allowed |
Both methods use the same Basic Authentication directives and the same .htpasswd file. Choose the central block when you control the server and want one authoritative policy; choose .htaccess when directory-level delegation is an explicit requirement.
Validate the configuration and reload Apache
Always run a syntax check before applying a change:
sudo apache2ctl configtestProceed only when the command reports a successful syntax check. Then reload Apache so it rereads the configuration without unnecessarily stopping the service:
sudo systemctl reload apache2Service-management details can vary by Ubuntu release, so confirm the command and service name against the release installed on your server. If the reload fails, inspect the Apache error log and check three items first: the spelling and permissions of /etc/apache2/.htpasswd, the exact AuthUserFile path, and whether the relevant <Directory> block matches the filesystem directory behind the URL.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesDo not treat a successful syntax check as proof that the intended URL is protected. Syntax validation confirms that Apache can parse the configuration; the HTTP tests below confirm that the active virtual host, directory mapping, credential file, and authorization rule work together.
Test the 401 challenge and successful access
Check an unauthenticated request
Request the protected URL without credentials:
curl -I https://example.com/private/An unauthenticated request should receive a 401 challenge. Test the HTTPS URL you actually intend to publish; using plain HTTP would leave Basic Authentication transport exposed. A response other than 401 is a signal to check the URL, selected virtual host, directory path, and active configuration.
Check a valid account
Supply the username and let curl prompt for the password:
curl -u alice https://example.com/private/A valid account should return the protected resource. If you changed the requirement to Require user alice, another valid account such as bob should not be authorized for that directory. Test from a client that reaches the same virtual host and URL path users will use, because a different host or path may select a different Apache configuration.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
Test both sides of the policy deliberately: no credentials, a known valid account, and—when you have added one—a valid account that is not named by a restrictive Require user rule. This distinguishes authentication failures from authorization failures and makes later troubleshooting much faster.
Troubleshoot common failures
Invalid command 'AuthType' or a similar directive error
This usually means Apache is reading the directive in a context where authentication overrides are not allowed, or the required authentication modules are unavailable. Move the rules into a valid virtual-host or <Directory> context, or enable AllowOverride AuthConfig for the directory when the rules belong in .htaccess. Confirm that the installed Apache authentication modules required by Basic Authentication are available, then rerun apache2ctl configtest.
.htaccess appears to be ignored
Check that the file is named exactly .htaccess, is in the directory that maps to the requested URL, and is covered by the active <Directory> block. Add AllowOverride AuthConfig (or an appropriately broader override), run the syntax check, and reload Apache. A correctly written file has no effect if the matching directory disallows authentication overrides.
Login prompts repeat
Verify the username and password, the realm text, and the absolute AuthUserFile path. Confirm that Apache can read the credential file with its current filesystem ownership and permissions. Repeated prompts can also occur when the request reaches a different virtual host or directory block than the one you edited, so compare the requested URL with the configured path.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Everyone receives 403 Forbidden
Authentication and authorization are separate checks. Review the Require rule: Require valid-user allows any successfully authenticated account, while Require user alice allows only the named account. Also verify the filesystem permissions on the target directory itself; a successful login does not grant Apache permission to read files it cannot access.
The credential file can be downloaded
Move it out of the document root and URI space immediately. The intended location is a protected filesystem path such as /etc/apache2/.htpasswd, referenced by its absolute path in AuthUserFile. After moving it, update the configuration, run apache2ctl configtest, reload Apache, and replace credentials that may have been exposed.
The reload fails after an apparently small edit
Run sudo apache2ctl configtest again and read the reported file and line context. Check quoting, spelling, the closing </Directory> tag, and the absolute credential-file path. If syntax is valid but the service still will not reload, inspect the Apache error log and verify that the edited file belongs to the active virtual host or included configuration.
Operational and security checklist
- Install
apache2-utilsbefore runninghtpasswd. - Use
htpasswd -conly when creating the new file; omit-cfor additional users. - Store the credential file outside the document root and Apache URI space.
- Use an absolute
AuthUserFilepath and ensure Apache can read it without making it broadly readable. - Choose either a central virtual-host/
<Directory>policy or a delegated.htaccesspolicy deliberately. - When using
.htaccess, permitAuthConfigoverrides in the matching directory. - Run
sudo apache2ctl configtestbefore every reload. - Apply changes with
sudo systemctl reload apache2and check the Apache error log if it fails. - Confirm that an unauthenticated HTTPS request returns
401and that valid credentials return the resource. - Use valid HTTPS/TLS before relying on Basic Authentication for sensitive content.
- Test the exact hostname, URL path, and virtual host that users will access.
- Review the
Requirerule whenever accounts are added or removed.
Removing protection
To disable protection managed in the central configuration, remove or comment out the authentication directives from the applicable virtual-host or <Directory> block, validate the syntax, and reload Apache. For a delegated setup, remove the authentication directives from the applicable .htaccess or stop allowing authentication overrides for that directory. Keep the credential file protected unless you are certain no other site or directory uses it.
Free tools Windows power users keep installed
One-click scans. No signup required.
If the file is no longer needed anywhere, remove it through the normal administrative process after confirming that no active configuration references it. If accounts or the file may have been exposed, replace the affected credentials rather than simply disabling the URL.
Frequently asked questions
How do I password-protect a directory in Apache on Ubuntu?
Install apache2-utils, create an .htpasswd file outside the web root, and add Basic Authentication directives in a matching virtual-host or <Directory> block. Alternatively, put the directives in .htaccess and allow AuthConfig overrides for that directory.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
How do I create an .htpasswd file?
Run sudo htpasswd -c /etc/apache2/.htpasswd alice and enter the password when prompted. Use the same path without -c—for example, sudo htpasswd /etc/apache2/.htpasswd bob—for later accounts.
Why does Apache ignore my .htaccess authentication?
The matching <Directory> block probably does not permit authentication overrides. Add AllowOverride AuthConfig, verify the file name and directory mapping, run apache2ctl configtest, and reload Apache.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsCan I store the password file inside /var/www/html?
No. Keep it outside the document root and Apache’s URI space so a browser cannot fetch it. Use a protected filesystem path such as /etc/apache2/.htpasswd.
What is the difference between Require valid-user and Require user alice?
Require valid-user permits any account that successfully authenticates against the configured file. Require user alice permits only Alice, even if other accounts have valid password records.
Is Basic Authentication safe over HTTP?
No. Apache states that Basic Authentication sends the password from client to server unencrypted. Use a valid HTTPS/TLS configuration before protecting sensitive content with this method.
Do I need to write AuthBasicProvider file?
Apache documents file as the default provider, so the directive is optional when you intend to use the flat password file. Keeping it explicit can make the configuration easier to audit.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Why do authenticated requests still return 403?
Check the authorization rule and filesystem permissions. A successful login does not override a restrictive Require user rule or give Apache permission to read the protected directory.
Frequently Asked Questions
How do I password-protect a directory in Apache on Ubuntu?
Install apache2-utils, create an .htpasswd file outside the web root, and configure Basic Authentication in a matching
How do I create an .htpasswd file?
Run sudo htpasswd -c /etc/apache2/.htpasswd alice for the first account. Omit -c when adding later users so the existing file is preserved.
Why is my .htaccess authentication ignored?
The matching
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Is Apache Basic Authentication secure without HTTPS?
No. Basic Authentication sends the password unencrypted, so use a valid HTTPS/TLS configuration before relying on it for sensitive content.
Why does a valid login receive 403 Forbidden?
Review the Require rule and the protected directory’s filesystem permissions. Authentication succeeds separately from authorization and file access.
The Bottom Line
For Ubuntu Apache, install apache2-utils, create /etc/apache2/.htpasswd with htpasswd -c only once, and keep that file outside the web root. Protect the matching directory with Basic Authentication directives in a central configuration block, or use .htaccess only with AllowOverride AuthConfig. Run apache2ctl configtest, reload Apache, verify a 401 challenge and successful authenticated access, and use HTTPS because Basic Authentication alone does not encrypt passwords in transit.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
