Password protection is a main used feature of htaccess. It is also a bit more difficult to setup and use.

The first thing you have to do is create a new file. This one is called the **.htpasswd** file. (Notice the file name/extension resemblance to our current subject.) This type of file is created and saved in the same fashion as the htaccess file. The htpasswd file will contain user names and their passwords.

Now that you have the file created, you have to enter the information into it. The information is stored such like...
username:password
username:password
username:password

The username, a colon, and password are on individual lines and do not have any spaces at the end of each line.

Seems easy so far? Well, it's time to toss in a bit of trouble now. The username parts are easy enough as they remain in "real" english. The password parts however must be **encrypted**. That means it has to be scrambled into a code. This helps our cause for security considering you ARE password protecting something here.

Need to encrypt the password? There are many online scripts available that do this for you. Just do a quick internet search and you should find them. We offer this online service for you through the link below.

OK, you have the file created, you have the usernames and passwords entered. Ready for another twist? The file must be uploaded in ASCII format and stored above your **WWW** or **public_html** folder. That is, in your online root (home) folder. (You may have to ask your host provider exactly what path this is and where it is located.)

If you are done all of that, it's time to move onto the htaccess part of the show...

As stated in a previous page, the htaccess file will affect the current directory only plus any subdirectories connected to it. So be sure you are placing this into the right place. Sometimes just one directory part needs protection, sometimes the whole site.

Here is the coding to add to the htaccess file:

<Code
  language="htaccess"
  text={`AuthUserFile /home/pathto/.htpasswd
AuthType Basic
AuthName "Secret Place"

<LIMIT GET POST>
require valid-user
</LIMIT>`}
/>

Lets break this down to an understandable level now. Starting with the first line.

## AuthUserFile /home/pathto/.htpasswd

This lets the browser find the right path to find the htpasswd file you created and saved earlier. After the AuthUserFile you enter a forward slash then continue on with the path leading to the actual filename.

## AuthType Basic

There are a couple of different flavors of encryption processing. Basic is the most common and used.

## AuthName "Secret Place"

The value in quotes will appear as the title in the popup message box when the visitor hits the protected area.

<Code
  language="htaccess"
  text={`<LIMIT GET POST>
require valid-user
</LIMIT>`}
/>

This tells the browser to check the entered information against the saved htpasswd file.

And that's it. Now when a visitor tries to access a page within a protected directory, they will get a popup asking them for a username and password. If they enter bad information, they will get directed to an error page.

If you wanted to password protect a specific page only, you can try this as your htaccess coding:

<Code
  language="htaccess"
  text={`<files "filename.cgi">
AuthUserFile /home/pathto/.htpasswd
AuthType Basic
AuthName "Secret Place"
require valid-user
</files>`}
/>

You can protect the actual .htaccess file from being viewed by visitors by using this code:

<Code
  language="htaccess"
  text={`<files ".htaccess">
order allow,deny
deny from all
</files>`}
/>

Learn about how password protection can work 

Password Protection

Bandwidth is the amount of data (information) being sent from the host server to the visitors computer. Each text letter, image, web page, and so forth is all really a bunch of data. A visitor comes to your web page, and all the data for displaying in their browser is transferred into their computer.

Bandwidth theft (or hotlinking) is when someone else's site is linking directly to an image (or something) on your site instead of downloading the image and uploading it to their own server.

This may not sound like a problem, but in some cases it can be a big one. Imagine you made an image and 100 other sites coded THIER pages to find that image on YOUR hosted area. If it was just your page alone, the bandwidth data transfer would be very small. Now that a hundred other sites are using the image on your server, that data transfer amount has just gone through the roof. Although this may not impact your site itself, your host server will be bogged down with all this extra transferring. Thus they may make you pay more dollars for hosting and/or cut you off entirely!

This is not a solution to prevent a visitor from taking (saving) your image for use on their site. It is a prevention of linking directly to the image from your site to thiers.

Using htaccess, you can have the hotlinked image appear as a broken (not found) image or you can replace it with a new image of your own design.

<Aside
  title="Important"
  content="Before doing any of this, you have to find out from your web host if they support mod_rewrite. If it does not, the rest of this page won't help you."
/>

You verified that mod_rewrite is active? Good. Now organize your image files a bit so they are in one separate directory. Most people do this already and it helps for main organization anyways.

Now in the htaccess file that you save in that image directory, put this coding in...

<Code
  language="htaccess"
  text={`RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg)$ - [F]`}
/>

Replace **mydomain.com** with your actual domain name. That would take care of GIF and JPG files. You could add more to the coding to include MID and other file types. A broken or missing image should now appear on the other person's site.

To add in a replacement image...

<Code
  language="htaccess"
  text={`RewriteEngine on
RewriteCond %{HTTP_REFERER} !^$
RewriteCond %{HTTP_REFERER} !^http://(www\.)?mydomain.com/.*$ [NC]
RewriteRule \.(gif|jpg)$ http://www.mydomain.com/badimage.gif [R,L]`}
/>

As before, replace the mydomain.com with your own actual domain name and now replace the new image file location.

<Aside
  title="Important"
  content="make sure the replacement image is not being stored inside a hotlink protected directory. it must be in an 'open' directory."
/>

Learn how you can prevent bandwidth theft (aka hotlinking) using htaccess files.

Kill Hotlinks

Most hosts will specify that your default starting page should be named **index** with whatever extension on it (usually .html). Using the abilities of htaccess, you may change this behavior to specify any other page and extension you prefer.

<Code
  language="htaccess"
  text={`DirectoryIndex filename.html`}
/>

You may also list an assortment of filenames in case you have different directories and want to load in the appropriate default page. Give the command a list of values. The command will go through the list one by one and will display the first valid one it comes across.

<Code
  language="htaccess"
  text={`DirectoryIndex filename.html index.cgi default.htm foo.html index.html`}
/>

When a visitor tries to access the directory this htaccess is contained in, it will try to find filename.html to display it. If it isn't found, the next entry is tried, and so forth down the line...

**What if none of the files exist?**

The visitor will be shown the 404 Page Not Found error page.

Learn how you can change the deafult directory page using an htaccess file.

Change default dir page

If you have no index or default page in a specific directory, a visitor may be served with a full list of files that the directory contains. This is usually not a good idea as it could pose a security risk. To counter this effect, add this to the htaccess file.

<Code
  language="htaccess"
  text={`Options -Indexes`}
/>

Another way to turn off an index listing is:

<Code
  language="htaccess"
  text={`IndexIgnore *`}
/>

That states the directory should not list "all" files. The star symbolizes all files.
Just the opposite situation may arise too. If you really do want directory listing to happen but the main server settings have it turned off, you may turn it on like this:

<Code
  language="htaccess"
  text={`Options +Indexes`}
/>

To have a directory listing turned on BUT have no image files showing:

<Code
  language="htaccess"
  text={`IndexIgnore *.gif *.jpg`}
/>

So any files that do not have a GIF or JPG extension on them would be allowed to be listed.

Learn how you can toggle a directory list of all available files on or off.

Directory on / off

The htaccess file is stored in the main site directory and/or in any subdirectory. The commands in this file will affect both the directory it is in and any of its own subdirectories. So, if you have one in your main directory, it will affect your whole site. If you place one in a subdirectory it will affect all the contents of that subdirectory (including any of its own subdirectories).

If you've worked with CSS coding, this effect may sound familiar. Each file in a directory will be affected by the "closest" or most direct htaccess file available.

Learn about the cascading behavior of htaccess files.

Cascading Behavior

Some host servers may not be setup to handle specific file types such as mp3 or swf files. Using htaccess can fix this oversight. This oversight may actually be on purpose though, so check with the host administrator before doing this.

<Code
  language="htaccess"
  text={`AddType application/x-shockwave-flash swf`}
/>

**AddType** specified you are adding a new mime type (file type).
**application/x-shockwave-flash** is the actual mime parameter specs.
**swf** is the extension of the file type.

In the above example, we are showing how to add an SWF file which is a Shock Wave Flash file.

Learn how you can host different files types on your server by configuring mime types.

Mime Types

There may be times when you upgrade a section on your site. This usually means the pages have moved to a new location. Meta tags, javascript, and other methods can be a bit messy when it comes to redirection, so its htaccess to the rescue once again.

<Code
  language="htaccess"
  text={`Redirect /OldDir/OldFile.html http://www.domainname.com/NewDir/NewFile.html`}
/>

That example might appear to be on two lines due to resolution settings, but just like any other htaccess code line, it should be on one line only.

> Redirect space old_location space new_location

When the htaccess notices someone trying to access the old file, it will redirect the browser to the new file location specified. The new file location must be shown as the full URL address.

You may specify directories instead of single files as well. Just leave off the filename at the end of the values but keep the trailing slash.

Learn how you can configure redirects using an htaccess file.

Redirects

The htaccess gives you the ability to redirect the visitor to different pages if they try to access an invalid page. You can use a custom error page for any type of error as long as you know its number. Example: 404 Page Not Found. The layout for this command is:

> ErrorDocument errornumber /filename.html

So if you create a page called "NotFound.html" and you wanted to use it as the 404 error page, the command would be:

> ErrorDocument 404 /NotFound.html

If you want to keep all of the error pages in a separate directory, just include the directory name in the file path:

> ErrorDocument 404 /errorpages/NotFound.html

The most used error documents are:

* **400 - Bad Request**:  A generic kind of error that people get into by doing some strange stuff with your URL or scripts.
* **401 - Authorization Required**:  When someone tries to enter a protected area without proper authorization.
* **403 - Forbidden**: When a file with permissions not allowing it to be accessed by the user is requested.
404	Not Found	Kinda obvious.
* **500- Internal Server Error**: This may help you with internal server errors in any scripts you have running.

There are many others, but these are probably all you will ever need to know.

Learn about how to setup custom error messages in htaccess files.

Custom Error Messages

You don't need any special program or hardware to create an htaccess file. In fact, all you need is a regular, simple text editor such as Notepad.

Now the tricky part is saving the file. The htaccess file is a no-name filename with an eight letter extension.

**".htaccess"**

When you save files in a text editor, it will usually add a default extension to files, so you might end up with...

**".htaccess.txt"**

Here is how you fix this problem:
* File
* Save As...
* In the FILE TYPE box, choose ALL FILES
* In the FILE NAME box, type in ".htaccess"

And be sure you used quotes around the filename when you typed it in.

If that doesn't work, your FTP program should let you do a RENAME on a file to make it right.

Learn about how to create an htaccess file.

Creating htaccess

FTP stands for File Transfer Protocol. It is a program that connects directly from your computer to the host computer where your internet files are stored.

Uploading files in an FTP program happens in one of three different modes. Auto, Binary and Ascii. When you are uploading an htaccess file, it must be done in Ascii mode. To avoid all of the initial errors, make sure the setting is on Ascii.

The other aspect of FTP is the **CHMOD** which stands for **CH**ange **MOD**e. Basically it is a set of rules on what the directory or file is allowed to do (or not).

for a more detailed explanation. The CHMOD of an htaccess file should be 644 or (RW- R-- R--). That setting makes it usable as well as more secure.

Learn about how to upload and change permissions in htaccess files.

Upload & CHMOD

If your host supports the use of htaccess but not the use of SSI, there is probably very good reason for it. Please check with your host before doing this procedure.

<Code
  language="htaccess"
  text={`AddType text/html .shtml
AddHandler server-parsed .shtml
Options Indexes FollowSymLinks Includes`}
/>

The first line states that pages with an extension of shtml are valid files.
The second line adds a "handler" which is the actual SSI stuff. Any file with the shtml extension must be parsed by the server.
The third line makes it all mesh together on the server.

That's it. Now any pages you create on your site with the shtml extension will be able to use SSI coding.

**What about using SSI on .html extensions?**

Don't feel like renaming a bunch of files over to shtml extensions? Then try this instead:

<Code
  language="htaccess"
  text={`AddType text/html .shtml .html .htm
AddHandler server-parsed .shtml .html .htm
Options Indexes FollowSymLinks Includes`}
/>

A bit of caution on that last addition though. This will force ALL pages on your site with an html extension to be sent into the server for parsing even if it contains SSI commands or not. The extra time to do the parsing action is transparent to the human eye, but it may bog the server down doing all these extra commands when it isn't required.

Learn about Server Side Includes and how it's configured using an htaccess file.

Enable SSI

This will allow you to cancel visitor access from a specific IP. An IP is a special code number that is assigned to each web surfer when they log onto the internet. For example, YOUR current IP address is:


Now when you are looking at putting a block to that in the htaccess, the coding would be:

<Code
  language="htaccess"
  text={`order allow,deny
deny from
allow from all`}
/>

The first line tells the htaccess what you want to specify.

The second line would cancel a single, specific IP. This could be close to useless though considering dialup customers usually get a different IP every time they log on. Direct connection users may have one or two different IPs depending on their account. You could take the banning one step further to include a full "block" of IPs, but this would cancel the abilities of anyone else in the same area from accessing your section. To do this though, just leave off the last digits (keep the last period on).

The third line allows access to everyone else.

The access/ban can also use a domain name in place of the IP numbers. If htmlite.com was an Internet Provider, you would be able to allow (or deny) access by doing something like this:

<Code
  language="htaccess"
  text={`order allow,deny
deny from .htmlite.com
allow from all`}
/>

If a banned visitor tries to access the specified location (where the htaccess file is located) they will be seeing the 403 Forbidden Access Error Page.

If you want to deny everyone from accessing a directory (but still allow scripts and files to be used), then you can enter the deny from all code line. This could be useful to put into an image directory so someone cannot access that specific directory listing directly.

Learn about how to deny specific IP addresses in .htaccess files.

Deny via IP

**What is the .htaccess file?**
Specifically, it a simple ASCII text file.

**How do you create an .htaccess file?**
You can use a regular text editor such as Notepad or Simpletext.

**Where is the .htaccess file stored/saved?**
It is stored in your main site directory and/or in any subdirectory.

**What does the .htaccess file do?**
That is what the following pages will cover. There are some main uses such as personalized error pages, password protection and redirects. It does all that and more.

**Do all hosts support/allow this file?**
VERY IMPORTANT : check with your host if they allow this file to be used by you AND if they pose any restrictions on its use. This is also important to know before reading all of the following pages. It'd be a waste of time doing all that learning for nothing. This file is works on an Unix/Apache based host, not Windows/NT.

**Any other thoughts before heading into htaccess learning?**
Keep a backup of the original file in case of problems.

Individual commands in the htaccess file are meant to be on one line only. Be sure that text editor has word wrap turned off.

Learn about how .htaccess files can be used to configure servers.

.htaccess

Author

Table of Contents

Learn More About .htaccess