Fill in the details

Fields marked * are required; leave the rest blank for defaults

中文

Web server

Rules live in an .htaccess file in the directory, take effect immediately, and usually work on shared hosting.

Nginx has no .htaccess: the snippet must go into the server config and be reloaded, which shared hosting rarely allows.

Where the password file lives

(fill in the absolute path first)

Not sure what your path is?Show me how

Either of these prints it; paste the result above:

// Drop this in a php file at your web root and open it
echo __DIR__;
# Over SSH, from the web root
pwd

Shared-hosting control panels usually show it as "document root" under site information.

Some hosts block dot-files outright; rename it to something like htpasswd if yours does.

Users Stick to letters, digits and . _ - in usernames

Password format

10

Advanced Realm, Apache version, IP allowlist, exempt files, 401 page

The line shown in the browser login box (AuthName). RFC 7617 only guarantees ASCII here, so non-ASCII may render as garbage.

2.4 uses Require; 2.2 uses Order / Allow / Satisfy. The two are not interchangeable — leave it on 2.4 if unsure.

These sources get straight through; everyone else must log in. Separate entries with spaces or commas.

Files that skip authentication. Put callback endpoints and health checks here, or third parties will get a 401.

Fill this in and only these files require a login; everything else in the directory stays public. Leave blank to protect the whole directory.

What visitors see when they hit Cancel. If you give a path, that page must sit outside the protected area or you get a redirect loop.

Existing users are kept; any that match a name above are replaced with the new password.

Ctrl + Enter works too
Hash checker Does an existing hash match a password?
No login box, or a straight 500?
  • 500 with AuthUserFile ... not allowed here in the log: AllowOverride for that directory is None. Set it to AuthConfig or All — and that can only be done in the main config, not from .htaccess.
  • 500 with Invalid command 'AuthType': mod_auth_basic / mod_authn_file are not loaded.
  • The password is always rejected: check that AuthUserFile is an absolute path readable by the Apache user, then use the checker above to confirm the hash itself is sound.
  • Apache on Windows rejects $6$ / $5$ / DES: those rely on the system crypt(). Use bcrypt or APR1-MD5 instead.
Changed the Nginx config and nothing happened?
  • Most common: when nginx -t fails, a reload silently keeps the old config. Always read the nginx -t output before reloading.
  • Static files ask for a password but .php does not: the directives sit inside location / while PHP requests match a sibling location ~ \.php$. auth_basic is inherited only by nested locations, never by siblings. Move it up to the server level.
  • Every password is rejected: look for open() "..." failed in the error log - the path is wrong or the worker user (www-data / nginx) cannot read it. Once the path checks out, use the checker above to confirm the hash itself.
  • bcrypt is rejected: Nginx has no built-in bcrypt and hands it to the system crypt(). Older systems without libxcrypt do not support $2y$ - switch to APR1-MD5.
Is Basic auth secure enough?
Credentials are Base64-encoded and resent with every request — that is plaintext in practice. HTTPS is mandatory, otherwise anyone on the same network can read them. There is also no rate limiting and no CAPTCHA, so treat it as a way to keep casual visitors and crawlers out, not as a real login system.