Setup Basic HTTP Authentication (Folder Protect)

The Problem

You need a quick, server-level password wall on a staging site or admin area — not a full login system, just something that stops random visitors or search engines from stumbling onto it.

About this problem

HTTP basic authentication makes the web server itself ask for a username and password before serving anything from a folder. It uses a password file (.htpasswd) and a directive in .htaccess or the server config, and the application behind it does not need to know about it. That makes it a quick way to protect a staging site or admin folder.

People look for this when a development copy of the site is being indexed by Google or found by visitors, or when they want an extra barrier in front of an admin area. It is deliberately simple: one shared credential set, not individual accounts, and it blocks search crawlers too, so it must not be used on content meant to rank.

What's Included

• Setting up .htpasswd/.htaccess (or equivalent) protection on the specified folder
• Creating the credentials you'll actually use
• Testing that the protection works and the rest of the site is unaffected
• A quick note on how to add/change users later

What's NOT Included

• Full user-login systems (this is a single shared password wall, not individual accounts)
• Protecting content that's meant to stay public for SEO (incompatible by design — basic auth blocks crawlers too)
• Ongoing credential management

How It Works

1. I confirm your web server type (Apache or Nginx) and the exact folder to protect.
2. I create a .htpasswd file with hashed credentials, stored outside the public web root where possible.
3. I add the authentication directives to .htaccess or the server configuration for that folder.
4. I make sure the protection does not break the rest of the site or required public paths.
5. I test that the folder prompts for credentials, that the correct login works, and that other areas remain open.
6. I give you a short note on how to add, change or remove users later.

In practice: you buy the service, send over whatever access or details the job needs, I investigate and do the work, and you confirm it's resolved before we call it done.

Frequently Asked Questions

How do I password protect a folder on my server?

With HTTP basic authentication, using a .htpasswd file and a rule in .htaccess or the web server configuration. I set it up and test it.

Will this stop Google indexing my staging site?

Yes, because crawlers cannot pass the login prompt, so they cannot read the pages.

Can I use this on pages that need to rank in search?

No. Basic authentication blocks search engines as well as visitors, so it is not suitable for public content.

Can each person have their own login?

You can have several username and password pairs, but this is a shared server-level wall, not a user account system.

Is basic authentication secure?

It is reasonable as a simple barrier when the site uses HTTPS, but it is not a replacement for a proper login system.

Do you manage the passwords afterwards?

No. I explain how to change them, but ongoing credential management is not included.