Protecting an Apache-Hosted Website with Basic Authentication

The companion article Creating and Managing Users with Apache htpasswd shows how to create the credential file. The next step is configuring Apache HTTP Server to require those credentials for a protected resource.

Configure the Protected Resource

Open the Apache configuration that defines the relevant virtual host or directory and add the authentication directives. The original configuration example is preserved here:

<VirtualHost *:80>
    DocumentRoot "/var/www/<folder>"
    ServerName subdomain.domain.com
    ServerAlias www.subdomain.domain.com
    <Directory "/var/www/<folder>">
        AuthType Basic
        AuthName "Authentication Required"
        AuthUserFile /etc/.apache_users
        Require valid-user
        Options Indexes FollowSymLinks
        AllowOverride All
        Order allow,deny
        Allow from all
    </Directory>
    ErrorLog "/var/log/httpd/subdomain.domain.com-error_log"
    CustomLog "/var/log/httpd/subdomain.domain.com-access_log" combined
</VirtualHost>

The key directives are:

• AuthType — selects the authentication mechanism.
• AuthName — provides the authentication realm shown to the client.
• AuthUserFile — points to the htpasswd credential file.
• Require — defines who is authorized after authentication.

If an existing configuration contains a permissive rule such as Require all granted, make sure it does not override the protection you intend to apply.

Restart and Verify

After changing the configuration, validate the Apache configuration and restart or reload the server using the appropriate command for the operating system. Then request the protected URL and confirm that authentication is required.

Security Considerations

HTTP Basic authentication transmits credentials in an encoded form, not encrypted by itself. Use HTTPS/TLS for any real deployment so credentials are protected in transit. Keep the htpasswd file outside the public document root and restrict filesystem access to it.

Takeaway

Authentication is effective only when both the credential store and the web-server authorization rules are configured correctly. Verify the final behavior from an unauthenticated client rather than assuming the configuration is protected because the directives are present.