Skip to main content

Protect a directory with .htaccess

How to protect a directory so it is no longer accessible via a browser.

Neele de Jonge avatar
Written by Neele de Jonge
Updated over a year ago

As of RB 2.0, it is finally possible to use the .htaccess file. Boxes from the Pro XL tariff or those that are not on the RB 2.0 infrastructure use NGINX and do not support .htaccess files. You can find more information in our article Do you support .htaccess files?

The .htaccess file provides an easy way to secure certain directories of your website with password protection. This article explains step-by-step how to set this up.

Your .htaccess file may already contain important instructions for the functionality and security of your website. These should not be changed or deleted without sufficient knowledge.

Step 1: Create a .htpasswd file

  1. Create a .htpasswd file:

    • Use a tool like the htpasswd Generator to create it.

    • Enter a username and password, and the tool will generate an encrypted line.

  2. Example:

    username:$apr1$zH...$...abcd1234...

  3. Save the .htpasswd file:

    • Save the generated line in a file named .htpasswd.

    • Upload the .htpasswd file to the same directory where your .htaccess file is located.
      ​

Step 2: Modify the .htaccess file

  1. Open or create a .htaccess file in the directory you want to protect.

  2. Add the following code to the .htaccess file:

    AuthType Basic
    AuthName "Protected Area"
    AuthUserFile ./.htpasswd
    Require valid-user


    Replace ./.htpasswd with the actual path to the .htpasswd file if you placed the file in a different directory.

Example: Protecting the "invoices" folder in wp-content

Suppose you want to protect the wp-content/invoices folder, but WooCommerce should still have access. Add the following configuration to the .htaccess file in the invoices folder:

AuthType Basic
AuthName "Protected Area"
AuthUserFile ./.htpasswd
Require valid-user

Replace ./.htpasswd with the actual path to the .htpasswd file if you placed the file in a different directory.

Before making any changes, create a backup of your current .htaccess file to undo unwanted changes. We keep a .htaccess.backup file in the WordPress root directory at all times.

Protecting your directories with .htaccess is an effective way to secure sensitive areas of your website. Follow the steps carefully to ensure that only authorized users have access.

If you have any uncertainties or questions, please contact your web developer or our support team.

Did this answer your question?