How do I add another user later?

Add a new line to the .htpasswd file, or run htpasswd without the -c option.

How do I remove password protection?

Delete the authentication lines from .htaccess. You can delete the .htpasswd file afterwards.

Why does the login box keep reappearing?

The username or password is wrong, or the stored hash does not match. Generate the line again and check for extra spaces.

Apache Basic Authentication: Password Protect a Folder Step by Step

Password protect a folder or whole site in five steps, with the exact configuration to copy.

Step 1: create the password file

Use the htpasswd generator for Apache to create a line for each user, or run the command on your server:

htpasswd -cB /home/site/.htpasswd admin

Use -c only for the first user, because it creates the file and overwrites any existing one.

Step 2: store it safely

Keep the file outside the public web folder, and note its full path.

Step 3: add the .htaccess rules

AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/site/.htpasswd
Require valid-user

Save this as .htaccess inside the folder you want to protect.

Step 4: allow overrides

Apache must be allowed to read authentication rules from .htaccess. In the server configuration, the folder needs AllowOverride AuthConfig, or AllowOverride All.

Step 5: test

Open the folder in a private browser window. You should see a login box. If you get a 500 error, check the AuthUserFile path first.

Use HTTPS

Basic authentication does not encrypt credentials. Serve the protected area over HTTPS so they are protected in transit. For the strongest stored hashes, choose bcrypt with the bcrypt generator.

Create your password file. Generate bcrypt, APR1 or SHA-1 entries in your browser, with the matching Apache config.

Open the htpasswd generator

Apache Basic Authentication: Step by Step