Skip to content

Set up basic authentication

Want to put a username and password prompt in front of a site, or in front of one path inside it?

This article walks through setting it up. For the concepts, being the three pieces, the rule that they all have to belong to the same site, and the Apache-vs-nginx difference in how you limit the protected area, see All about basic authentication.

What you'll create

Three things, in this order:

  1. An htpasswd file on the account that owns the site.
  2. One or more htpasswd users inside that file.
  3. A basic authentication realm that attaches the file to the site.

All three have to belong to the same site.

1. Create the htpasswd file

Open the account that owns the site you'll protect — directly from 'UNIX Users', or via 'Projects' > the project > 'Advanced' > the 'UNIX User' tile's 'Manage' button.

  1. Under 'Htpasswd Files', click '+'.
  2. Enter a 'Name'. Lowercase letters, digits, dash, underscore.
  3. Click 'Create'.

2. Add htpasswd users

Open the htpasswd file you just created.

  1. Under 'Htpasswd Users', click '+'.
  2. Enter a 'Username' and 'Password'.
  3. Click 'Create'.
  4. Repeat for each person who should have access.

3. Attach a basic authentication realm

Open the site you want to protect — directly from 'Virtual Hosts', or via 'Projects' > the project > 'Advanced' > the 'Virtual Host' tile's 'Manage' button.

  1. Under 'Basic Authentication Realms', click '+'.
  2. Enter a 'Name'. The browser shows this in its login prompt, so pick something the visitor will recognise, for example Staging: client name.
  3. Pick the 'Htpasswd File' from step 1. Only files belonging to the same site appear.
  4. Scope the protected area. Set the field that matches the web server the site runs on, and leave the other blank:
    • Apache — 'Directory Path'. /admin protects that subdirectory; blank protects the whole document root.
    • nginx — 'URI Path'. /admin protects any URI starting with that; blank protects the whole site.
  5. Click 'Create'.

The next request to the protected part of the site prompts for credentials.

Multiple realms

A site can have several realms, for when different paths need different credentials.

Repeat step 3 with a different htpasswd file, or the same file with a different scope and name.

Restricting by IP instead

For "only the office can reach this" rather than a credentials prompt, use firewall groups on the domain router.

You can use both on the same domain. If one is misconfigured, the other still blocks access.