I only have a web hosting solution which doesn't include a server config access, this is a mutualized solution.
I would like to try to allow users to access my website only if they have the expected login/password credentials, by using a .htaccess file and a .htpasswd file. However, without access to the Apache config folders, I am not sure that I can add this htpasswd file to a location reachable from the htaccess file.
Am I right about this or do I have a way to do it?
The path for the password file has to be based on your user home directory, not the website url. So something like this (assuming that your website folder is called public_html.
AuthName "Protected <foldername>"
AuthType Basic
AuthUserFile /public_html/.htpasswd
Require valid-user
But thats a dangerous place to put, it should really be before the public_html directory.
Since you dont have access there, place it in a subfolder such as private and protect it with access rights and htaccess.
AuthUserFile /public_html/private/.htpasswd
Your path may include the home directory name (which could be based on your username or domain name so perhaps
AuthUserFile /home/<example.com>/public_html/private/.htpasswd
If you have php, you can find the path with this script
<html>
<body>
<?php
echo getcwd(),'<br>',PHP_EOL;
?>
</body>
</html>
Or implement the password access with php.
.htpasswd file is unreachable. I have tried with public_html, www, htdocs... I'm a bit lost now.
Commented
Mar 1, 2023 at 14:35
AuthUserFile directive should be an absolute filesystem path. (It can also be relative to the ServerRoot, but you likely don't know what the ServerRoot is so that is rarely a viable option.) This is not "based on your user home directory", but simply the file structure of your server. This will naturally vary from server to server. You should be able to get the document-root directory from your webhost. @AnotherDude
This is dependent on how the webserver is set up. From your comments it seems that the web server is not Apache or that .htaccess access is restricted when in the website root directory. It is possible for your provider to lock down a web server to prevent this kind of access.
Depending on the website and server configuration it MIGHT be possible to modify the way everything works by having a PHP script override index.html and implement some authentication, but I don't think this is likely to be bullet proof or very practical - ie it would likely be easier to move to another host.
Another remote possibility might be to put the website behind a reverse proxy of some sort that requires authentication. Again, likely more work then just shifting to another web provider.
.htaccessfile at the root of my website (with myindex.htmlfile), but then I tried adding my.htpasswdfile at the same location, and accessing it from my htaccess file in various ways, which always fail. I have triedAuthUserFile .htpasswd,AuthUserFile ./.htpasswd,AuthUserFile http://my_website.com/.htpasswd... nothing seems to work.