I'm setting up a directory on an Apache server protected with mod_authn_file. The docs for AuthUserFile say not to put the .htpasswd file in the protected directory:

Make sure that the AuthUserFile is stored outside the document tree of the web-server. Do not put it in the directory that it protects. Otherwise, clients may be able to download the AuthUserFile.

It's not clear to me exactly what this means. Is it only authorized users that may be able to download it, or is there a risk that others may have access as well?

The directory I am protecting will only ever have one authorized user. He already knows his username and password. Is there any reason not to keep the .htpasswd file in the protected directory right next to .htaccess?

1 Answer 1


By default, Apache is suppose to deny access to .htaccess and .htpasswd files. For some weird reason, you have the ability to disable it (accidentally or otherwise) in your configuration. If you have disabled this protection somehow (or if, for some reason, it wasn't setup in the first place), then any malicious attacker could exploit this to download the .htpasswd file.

Normally the suggestion is to have the file outside of your web directory, preventing it from ever being served to a user, while still giving Apache access to it.

  • To be clear, are you saying that if that setting is disabled, the server will allow access to the .htpasswd file for an unauthorized user even though every other file in the directory is protected?
    – Robert
    Commented Nov 19, 2015 at 5:21
  • @Robert, if .htpasswd protection is disabled, anyone who can download files from the directory can download the .htpasswd file. If this file contains more than one password, or a setup issue lets the user bypass the password protection, they can get information they shouldn't. Putting .htpasswd outside the document tree prevents this.
    – Mark
    Commented Dec 16, 2015 at 6:43

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .