I am trying to lock a folder called locked with the encrypted user passwords stored in .htpasswd. This does not work:

AuthUserFile /srv/http/.htpasswd
AuthType Basic
AuthName "Login Required"
<Files "locked" >
    Require valid-user

<Files> is designed for specifying files, not directories. E.g:

<Files admin.php>
    deny from all

Use one of the following:

  • <DirectoryMatch>
  • <Directory>
  • <Location>
  • <LocationMatch>

But it should be noted that you must have mod_setenvif and mod_auth enabled, virtual host with AllowOverride AuthConfig and take note that <location> and <LocationMatch> only work in the virtual host configuration, i.e /sites-enabled/example.conf.

But there is a much easier way than any of the above...

Simple create another .htaccess file in the directory you want to protect:

 AuthName "restricted stuff"
 AuthType Basic
 AuthUserFile /usr/local/etc/httpd/users
 require valid-user*
| improve this answer | |
  • 2
    Both <Directory...> and <Location...> wrappers are server config only. .htaccess in the appropriate directory is the userland equivalent of the <Directory> wrapper, so as you suggest, you just put it in the directory you want to protect. Aside: Why is mod_setenvif_ required here? (It's enabled by default anyway.) +1 – DocRoot Jun 1 '17 at 22:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.