At the moment, I have a directory that's password protected by .htaccess and .htpasswd. The problem with this is that when a visitor comes to my site, they get an ugly inbuilt Secure Area message rather than going through a friendlier-looking login page.

The only other way I know to password protect online is using PHP files that redirect if the user doesn't have a login cookie, but the problem with this is that although it protects pages of the site, it doesn't protect other site content (such as image and PDF files).

How can I make sure that all files within a directory are protected by a login while still presenting that login in a user-friendly way?


1 Answer 1


You need to deny access to the files by the webserver - there's 3 ways to do this: move the files outside the document root, tell the webserver not to allow access to the files in the directory tree where your content resides or (if you're running PHP as a different uid than the webserver) change the permissions so only PHP can read them. Then you need to route all requests for the content via a PHP script which verifies the authenticated session of the user before serving the content. It's not rocket science.

It's made a bit simpler if you implement the PHP proxy script as the 404 handler.

The problem is that performance/capacity/throughput will be poor.

There are different things you can do to tweak the security / performance - but it depends on how much security / performance you need.

  • I've spent the last couple hours Googling for solutions based on keywords from your post, and I still don't understand a solution. You suggest that I use a "PHP script which verifies the authenticated session of the user." Could you (or anyone) please explain how to get this authenticated session in a user-friendly way in the first place? I need any method that makes sure the PDF can't be accessed on the open web and that allows me to add a user-friendly login page. Please explain or provide links. Thanks!
    – 3nafish
    Jan 23, 2013 at 4:10
  • You said "I know to password protect online is using PHP files that redirect if the user doesn't have a login cookie" but now you're asking how to implement this?
    – symcbean
    Jan 23, 2013 at 11:27
  • Thanks for replying. I know how to prevent access to individual PHP pages with cookies (use the php setcookie() method, check if the user has a cookie, redirect to login page from any PHP page they try to access without the cookie), but as far as I can tell the .htaccess method (like that described at thesitewizard.com/apache/password-protect-directory.shtml) doesn't use cookies, but establishes some other sort of session instead.
    – 3nafish
    Jan 23, 2013 at 14:23
  • Am I misinterpreting something? How do I interface between the two? The way I see it at the moment, if I use the first method, my PDF is still publicly accessible because I don't know how to redirect access like I would with a PDF, but if I use the second method and protect it with .htaccess, the browser gives only an inbuilt authentication message rather than letting me build a custom one. I suppose basically I'm asking how to take the cookie from PHP's setcookie() method and pass it into the inbuilt .htaccess prompt for directory access without that prompt ever appearing.
    – 3nafish
    Jan 23, 2013 at 14:23
  • No - setcookie is not the answer - in order for this to be secure you need to verify the cookie value - PHP already has a mechanism for this - sessions.
    – symcbean
    Jan 23, 2013 at 23:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.