I am trying to lock a folder called locked with the encrypted user passwords stored in .htpasswd. This does not work:

AuthUserFile /srv/http/.htpasswd
AuthType Basic
AuthName "Login Required"
<Files "locked" >
    Require valid-user

1 Answer 1


<Files> is designed for specifying files, not directories. E.g:

<Files admin.php>
    deny from all

Use one of the following:

  • <DirectoryMatch>
  • <Directory>
  • <Location>
  • <LocationMatch>

But it should be noted that you must have mod_setenvif and mod_auth enabled, virtual host with AllowOverride AuthConfig and take note that <location> and <LocationMatch> only work in the virtual host configuration, i.e /sites-enabled/example.conf.

But there is a much easier way than any of the above...

Simple create another .htaccess file in the directory you want to protect:

 AuthName "restricted stuff"
 AuthType Basic
 AuthUserFile /usr/local/etc/httpd/users
 require valid-user*
  • 2
    Both <Directory...> and <Location...> wrappers are server config only. .htaccess in the appropriate directory is the userland equivalent of the <Directory> wrapper, so as you suggest, you just put it in the directory you want to protect. Aside: Why is mod_setenvif_ required here? (It's enabled by default anyway.) +1
    – DocRoot
    Commented Jun 1, 2017 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.