Tutorial - Protect a directory or administration interface of your website with .htaccess and .htpasswd files

View as Markdown

Find out how to protect a directory or administration interface by authenticating with .htaccess and .htpasswd files

Objective

This tutorial explains how to set up user/password authentication to access all or part of your website via an Internet browser.

You can do this by using two Apache configuration files (HTTP) to place in the FTP space of your web hosting plan:

Information regarding OVHcloud service administration and how to find appropriate assistance

When using OVHcloud guides, please be aware of the following conditions:

  • User instructions aim to provide as many details as possible but cannot cover individual use cases. You might need to adapt the pertinent actions to your requirements.
  • The OVHcloud ecosystem is built for flexibility and freedom of choice. Customers are therefore responsible for the secure and proper configuration of their services. To prevent data loss, we strongly recommend to apply backup strategies to all your important data.
  • Our guides and tutorials may reference third-party software or services in combination with OVHcloud solutions. The technical support provided by OVHcloud does not include the configuration of systems or products outside of our responsibility. This includes but is not limited to:
    • Operating systems and user interfaces (Windows, Debian, Plesk, etc.).
    • Any other third-party software (FTP clients, email software, etc.).
    • Services offered by other providers (DNS, APIs, user interfaces, etc.).

To receive the appropriate assistance for any issues you might experience, follow these guidelines:

  • You seek personalized advice or you would like to discuss a topic that is not covered in detail by our documentation?
    Join the OVHcloud Community to search for your topic and reach out to other users.
  • You need to report an incident regarding your OVHcloud service or you are experiencing difficulties in the OVHcloud Control Panel?
    Create a support request in our Help Centre.
  • You require professional assistance for your project or you need help with tasks outside our support scope?
    Visit our partner portal to search for experts who are familiar with OVHcloud solutions.
  • You are looking for more detailed information regarding our support levels and Professional Services?
    Please visit our web pages for OVHcloud support levels and OVHcloud Professional Services.

You can participate in improving our documentation:

  • You would like to share feedback to improve a guide page or you want to report insufficient information on a specific page?
    Use the "Was this page helpful?" buttons at the bottom of the page to let us know.
  • You would like to propose a specific documentation update?
    Use the "Edit this page" function, available at the bottom of the page and in the sidebar.

Find out how to protect a directory or the administration part of your website by authenticating with the .htaccess and .htpasswd files.

Requirements

Instructions

Info

The security solution proposed here is only one technical possibility.

For example, if you use a Content Management System (CMS), other security solutions exist.

If you are using a WordPress CMS, OVHcloud also provides a tutorial on how to use the .htaccess file with WordPress.

If you have any questions regarding the creation, use or programming of your website, OVHcloud support will not be able to provide you with assistance in this regard.

To do this, contact our user community or OVHcloud partners.

We will explain the 4 main steps to take to protect access to a directory or all or part of your website:

  • Create “crypt.php”, “.htaccess” and “.htpasswd” files
  • Generate encrypted passwords with the “crypt.php” file
  • Define encrypted users and passwords with the “.htpasswd” file
  • Configure rules in the “.htaccess” file and delete the “crypt.php” file
Warning

The steps that follow will optimise the security of your hosted data. Therefore, if your websites are compatible, we strongly recommend that you use the most recent PHP version possible.

To modify the PHP version of your websites on your web hosting plan, please refer to our guide: Web Hosting: Environment, PHP version, .ovhconfig.

The scripts and information described below in this tutorial only work with a runtime environment and a recent PHP version.

Otherwise, we recommend that you optimise your website to make it compatible before setting up the following. This will further reduce the risk of security vulnerabilities being exploited to hack into your website.

Step 1: Create the files "crypt.php", ".htaccess" and ".htpasswd"

Log in to the FTP storage space of your web hosting plan. Open the root folder that your domain name points to.

Create a "crypt.php" file in this root folder.

Open or create the website folder you want to protect. In our example below, it will be the "admin" folder. Create a ".htpasswd" file and a ".htaccess" file in this directory.

To use the ".htaccess" and ".htpasswd" files correctly, you need to follow the following rules:

  • Create Only one “.htaccess” and only one “.htpasswd” per directory or subdirectory, to avoid conflicts between different “.htaccess” files and different “.htpasswd” files.
  • The ".htaccess" and ".htpasswd" files are not visible to users visiting your website.
  • The rules declared in a ".htaccess" file apply to the entire directory where the ".htaccess" file is located, as well as to all subdirectories in that same directory.
  • The ".htpasswd" and ".htaccess" files can be in different folders. One ".htpasswd" file can be used for several ".htaccess" files.

Step 2: Complete the “crypt.php” file

Go back to the root folder where you created the file crypt.php. Click Edit and place the following lines:

<?php
$string = password_hash("plain_text_password", PASSWORD_BCRYPT);

echo nl2br("$string");
 ?>

Replace only plain_text_password with the clear password you want to encrypt.

You can adapt the script depending on the number of passwords you want to encrypt.

  • Example where the PHP script will encrypt 3 passwords in a single operation:
<?php
$string_1 = password_hash("plain_text_password1", PASSWORD_BCRYPT);
$string_2 = password_hash("plain_text_password2", PASSWORD_BCRYPT);
$string_3 = password_hash("plain_text_password3", PASSWORD_BCRYPT);

echo nl2br("$string_1 \n $string_2 \n $string_3");
 ?>

Replace plain_text_password1, plain_text_password2 and plain_text_password3 with the clear passwords you want to encrypt.

Info

The two scripts above use, to date, the most secure encryption method via the bcrypt algorithm recommended by Apache.

For more information on this subject, see the official Apache documentation.

If you have a Professional, Performance, Agency, Agency Plus or Agency Max hosting plan, then log in with SSH to your web hosting. Go to the root folder where your script “crypt.php” is located.

To do this, use the following command:

cd Name_of_your_root_folder

Replace Name_of_your_root_folder with the full path to the location of your script "crypt.php".

For example, if your file "crypt.php" is in a subfolder of your root folder use the following command:

cd Name_of_your_root_folder/sub_folder

Replace Name_of_your_root_folder with the name of your "root folder" and sub_folder with the subfolder where your script 'crypt.php' is located.

Once you are at the level where your script "crypt.php" is located, run the following command:

php crypt.php
Warning

For security reasons, SSH is recommended. However, if you have a Starter, Personal or Startup hosting plan where SSH is unavailable, you can also run the "crypt.php" file via your web browser.

To do this, enter the URL https://domain.tld/crypt.php and replace domain.tld by your own domain name. This is done directly in the address bar of your web browser.

Retrieve the encrypted passwords without copying the part “<br />” after running the command “php crypt.php” via SSH:

encrypted_password1
encrypted_password2
encrypted_password3

For example, the values encrypted_password1, encrypted_password2 and encrypted_password3 should look like the format of the following line:

$2y$10$8eO7Iq3rh.u3CXvhuhKq.Om.nQJN.Z1sBT2jvOqVKCGzP42T/4LBC

Only make sure that your encrypted passwords start with $2y$. This will confirm that your passwords have been encrypted using the secure bcrypt algorithm.

Step 3: Set encrypted users and passwords with the .htpasswd file

The ".htpasswd" file contains the respective encrypted passwords belonging to each of the users declared in the file. Only these users will be allowed to connect to the directory for which you want to protect access.

For each user, add a line indicating their username and encrypted password in this file:

user1:encrypted_password1
user2:encrypted_password2
user3:encrypted_password3

Replace the values user1, user2 and user3 in our example with your own user names.

Also replace the encrypted_password1, encrypted_password2 and encrypted_password3 with your own previously retrieved encrypted passwords.

Step 4: Configure rules in the .htaccess file

Blocking access to an entire directory

In the directory to be protected, create a ".htaccess" file with the following code:

AuthName "Indicates your login(s)"
AuthType Basic
AuthUserFile "/home/your_ftp_login/root_folder/admin/.htpasswd"
Require valid-user

In the script above, replace the following with your own values:

  • Indicates your login(s): This is the user (or users) authorised to access the full directory. If you have multiple users, separate them only with a space.
  • your_ftp_login: The FTP username used to log in to your FTP storage space. To retrieve your FTP login, please refer to our guide on logging in to your FTP space.
  • root_folder/admin/.htpasswd: Directory path from the FTP root of your web hosting plan to the ".htpasswd" file to be used to authenticate users authorised by the rule in your ".htaccess" file.

Blocking access to one or more files

To block access to one or more specific files, add a Files directive to the ".htaccess" file:

<Files test.php>

AuthName "Indicates your login(s)"
AuthType Basic
AuthUserFile "/home/your_ftp_login/root_folder/admin/.htpasswd"
Require valid-user

</Files>

In the script above, replace the following with your own values:

  • test.php: The name of the specific file or filegroup that contains, in our example, test.php (the text string for which the access restriction should apply).
  • Indicates your login(s): This is the user (or users) authorised to access files whose names contain test.php. If you have several users, separate them with a space.
  • your_ftp_login: The FTP username used to log in to your FTP storage space. To retrieve your FTP login, please refer to our guide on logging in to your FTP space.
  • root_folder/admin/.htpasswd: Directory path from the FTP root of your web hosting plan to the ".htpasswd" file to be used to authenticate users authorised by the rule in your ".htaccess" file.
Warning

You will need to specify a Files directive for each file to be protected.

Files directives apply to all files with the same name or ending with the specified name. This is provided that they are contained in the same directory as the ".htaccess" or in one of its subdirectories.

In the above configuration, because "new_test.php" contains test.php in its name, the Files directive would also apply to a file named "new_test.php" contained in a subdirectory of the "admin" folder.

Furthermore, until you authenticate yourself to access the files affected by the directive, they may not appear and therefore cannot be "listable" via an "index of" page.

Danger

Once you have finished setting up your ".htaccess" and ".htpasswd" files, delete the "crypt.php" encryption file from your web hosting plan.

Go further

Official Apache documentation

Logging in to your Web Hosting plan’s FTP space

Tutorial - Operations achievable with a .htaccess file

Tutorial - How do I block access to my website for certain IP addresses via a .htaccess file?

Tutorial - Rewrite the URL for accessing your website

For specialised services (SEO, development, etc.), contact OVHcloud partners.

If you would like assistance using and configuring your OVHcloud solutions, please refer to our support offers.

Join our community of users.

Was this page helpful?