1

I only have a web hosting solution which doesn't include a server config access, this is a mutualized solution.

I would like to try to allow users to access my website only if they have the expected login/password credentials, by using a .htaccess file and a .htpasswd file. However, without access to the Apache config folders, I am not sure that I can add this htpasswd file to a location reachable from the htaccess file.

Am I right about this or do I have a way to do it?

6
  • Do you have ftp access to your pages Feb 28, 2023 at 19:02
  • "without access to the Apache config folders" - What do you mean by this? What are "folders" in this context?
    – MrWhite
    Mar 1, 2023 at 1:20
  • htaccess file can specify where the htpasswd file is. So, thats not an issue. But you need to generate this file on your server. I only know how to do this on the command line, which you don't have access to. Mar 1, 2023 at 3:00
  • @MrWhite I mean that I tried this locally with a MAMP test server, and in this case I am able to access all the apache related folders, like htdocs, Library, conf... But in my case I don't have access to these folders, only to the www folder (the htdocs, I guess), where I can add files to my website with FTP/SFTP. Mar 1, 2023 at 13:49
  • @RohitGupta I guess this is the issue, I have added the .htaccess file at the root of my website (with my index.html file), but then I tried adding my .htpasswd file at the same location, and accessing it from my htaccess file in various ways, which always fail. I have tried AuthUserFile .htpasswd, AuthUserFile ./.htpasswd, AuthUserFile http://my_website.com/.htpasswd... nothing seems to work. Mar 1, 2023 at 13:51

2 Answers 2

2

The path for the password file has to be based on your user home directory, not the website url. So something like this (assuming that your website folder is called public_html.

AuthName "Protected <foldername>"
AuthType Basic
AuthUserFile /public_html/.htpasswd
Require valid-user

But thats a dangerous place to put, it should really be before the public_html directory.

Since you dont have access there, place it in a subfolder such as private and protect it with access rights and htaccess.

AuthUserFile /public_html/private/.htpasswd

Your path may include the home directory name (which could be based on your username or domain name so perhaps

AuthUserFile /home/<example.com>/public_html/private/.htpasswd

If you have php, you can find the path with this script

<html>
  <body>
  <?php
  echo getcwd(),'<br>',PHP_EOL;
  ?>
  </body>
</html>

Or implement the password access with php.

4
  • I tried this but looks like my .htpasswd file is unreachable. I have tried with public_html, www, htdocs... I'm a bit lost now. Mar 1, 2023 at 14:35
  • The file-path argument to the AuthUserFile directive should be an absolute filesystem path. (It can also be relative to the ServerRoot, but you likely don't know what the ServerRoot is so that is rarely a viable option.) This is not "based on your user home directory", but simply the file structure of your server. This will naturally vary from server to server. You should be able to get the document-root directory from your webhost. @AnotherDude
    – MrWhite
    Mar 1, 2023 at 18:40
  • @MrWhite - You are correct, obviously. I had a lapse of confusion with my login name being so similar to mywebsite folder name. Mar 1, 2023 at 21:07
  • @MrWhite Thank you for the explanation. I'm going to do this then. Mar 2, 2023 at 9:16
1

This is dependent on how the webserver is set up. From your comments it seems that the web server is not Apache or that .htaccess access is restricted when in the website root directory. It is possible for your provider to lock down a web server to prevent this kind of access.

Depending on the website and server configuration it MIGHT be possible to modify the way everything works by having a PHP script override index.html and implement some authentication, but I don't think this is likely to be bullet proof or very practical - ie it would likely be easier to move to another host.

Another remote possibility might be to put the website behind a reverse proxy of some sort that requires authentication. Again, likely more work then just shifting to another web provider.

1
  • Thank you, I am going to do this. Mar 2, 2023 at 9:15

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.