So I have a web directory running on a server and I want only people with the password to be able to get in.

Is it possible to secure the web root with .htaccess? Is there any extra steps I need to take?

I currently have tried setting it up as follows:

In a folder outside the web directory, I have /.../.../.htpasswd
.htpasswd is set up with a single, non encrypted password like:


Then I have /var/www/.htaccess htaccess looks like this:

AuthUserFile /.../.../.htpasswd
AuthName "Secured Area"
AuthType Basic
require valid-user

Its an apache web server running on ubuntu. I'm pretty sure it has support for this because the syntax highlighting is working in vim, but its not working. Do I need to restart the web server?

is it not possible to secure root?

sorry for the noob ?

also, I can still run scripts within the directory right?(as long as I'm in the dir first)

1 Answer 1


In /etc/apache2/sites-available/default, make sure you have AllowOverride All instead of AllowOverride None. With None, .htaccess files are not parsed/evaluated.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .