Recommended Free Tools
Apache handles the password prompt; PHP-FPM does not. Put an .htaccess file in the directory you want to protect, enable the AuthConfig override for that directory, and add Apache Basic Authentication directives that point to an htpasswd file. Apache challenges unauthenticated requests before an authorized PHP request is sent to PHP-FPM.
Antihost offers Linux VPS plans with full root access, unlimited traffic on a 1 Gbps port and a 14-day free trial.
The smallest working setup is:
AuthType Basic
AuthName "Restricted area"
AuthUserFile /etc/apache2/.htpasswd-private
Require valid-userThis protects the HTTP directory, including PHP scripts served from it. Use HTTPS, keep the password file outside the public document tree, and verify that the active Apache virtual host permits authentication directives in .htaccess.
As an Amazon Associate I earn from qualifying purchases.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minutePC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11How the protection works with PHP-FPM
A browser request passes through Apache first. Apache resolves the requested directory, reads applicable configuration and .htaccess files, and performs authentication and authorization in its security phase. Only after a request is authorized does Apache invoke the content handler that forwards a PHP script to PHP-FPM.
PHP-FPM is therefore not the component that displays the login dialog or checks the .htpasswd file. It receives an already-authorized PHP request through Apache’s FastCGI integration. An unauthenticated request should receive a 401 Unauthorized challenge and should not reach the PHP application at all.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
A deployment may connect Apache to PHP-FPM over a TCP address or a Unix-domain socket. The pool name, socket location, and filesystem paths vary by operating system and hosting provider, so retain the PHP-FPM mapping already supplied by your installation.
Prerequisites to check first
- Apache must be the web server serving the directory. An
.htaccessfile has no effect when another server handles the request. - You need permission to place an
.htaccessfile in the target directory and, on a managed host, permission to use authentication overrides. - The Apache installation must have Basic Authentication, a password-file authentication provider, and authorization support available.
- You need an Apache-readable password file created with
htpasswd. - Use HTTPS before protecting confidential content or credentials.
If you administer the virtual host or server configuration, a <Directory> block is normally preferable. It avoids per-request searches for distributed configuration files and gives you centralized control. .htaccess is useful when you cannot edit the main configuration, such as on many shared-hosting accounts.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Choose where to put the rules
Use .htaccess when you lack main-configuration access
Place the file directly in the directory whose URL space should require a login. For example, if the protected filesystem directory is /var/www/example/private, create /var/www/example/private/.htaccess. Apache applies the file to that directory and its descendants unless another configuration changes the behavior.
The filename must be exactly .htaccess, including the leading dot. Upload it as a text file, not as .htaccess.txt. Do not put the authentication directives in a PHP file; they are Apache configuration syntax.
Use a <Directory> block when you control Apache
The equivalent centralized configuration is conceptually:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
<Directory "/var/www/example/private">
AuthType Basic
AuthName "Restricted area"
AuthUserFile /etc/apache2/.htpasswd-private
Require valid-user
</Directory>After changing the main configuration, follow your distribution’s normal configuration validation and graceful-reload procedure. The exact service command differs by operating system, so do not substitute an unverified command on production systems.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minuteEnable authentication directives for .htaccess
Apache ignores or rejects authentication directives in .htaccess unless the relevant directory configuration permits them. In the virtual-host or server configuration, the target directory needs an override class containing authentication directives:
<Directory "/var/www/example/private">
AllowOverride AuthConfig
</Directory>AllowOverride AuthConfig is narrower and safer than enabling every override. Some installations use AllowOverride All; that also permits authentication directives, but it grants the directory’s .htaccess file substantially broader control. If overrides are disabled, the file can be present and readable yet have no authentication effect, or Apache can log a “not allowed here” error.
Make sure this block applies to the real filesystem path serving the request. A similarly named directory, a different virtual host, or a more specific <Directory> rule can leave the intended directory unprotected.
Create the password file with htpasswd
Create the file and first account
Choose an absolute filesystem path that Apache can read but that is not publicly downloadable. A common example is:
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
htpasswd -c /etc/apache2/.htpasswd-private aliceThe -c option creates a new password file and prompts for Alice’s password. Use it only for the first account. Running the same command with -c later replaces the existing file and removes the other accounts.
Add more accounts without replacing existing ones
htpasswd /etc/apache2/.htpasswd-private bob
htpasswd /etc/apache2/.htpasswd-private carolEach command prompts for the new user’s password and appends or updates that account while preserving the other entries. Use a unique username for each person so that access can be removed or audited individually.
Protect the password file itself
- Keep it outside the document root whenever possible, such as under
/etc/apache2or another administrator-controlled directory. - Set ownership and mode so Apache can read the file but unprivileged users cannot alter it. The correct owner and group depend on your operating system and Apache service account.
- If the file must be inside the document tree, add a separate rule that denies direct web access to it and verify that behavior. An outside-document-root location is safer because it cannot be requested as a URL.
- Back up the file as sensitive credential material and restrict access to those backups.
The path in AuthUserFile is a filesystem path, not a URL. Do not write /private/.htpasswd merely because that is the URL path; use the actual absolute path on disk.
Add the authentication directives
In the protected directory’s .htaccess, add:
AuthType Basic
AuthName "Restricted area"
AuthUserFile /etc/apache2/.htpasswd-private
Require valid-userWhat each directive does
| Directive | Purpose | Operational note |
|---|---|---|
AuthType Basic |
Selects HTTP Basic Authentication. | The browser sends an Authorization header after the challenge. |
AuthName |
Sets the realm displayed by browsers and used to distinguish credential caches. | Choose a descriptive label such as “Restricted area”; changing it can cause browsers to request credentials again. |
AuthUserFile |
Points Apache to the local password file. | Use an absolute filesystem path that Apache can read. |
Require valid-user |
Allows any username whose password successfully authenticates from that file. | Use a narrower Require expression when not every account should enter. |
Allow only named users
To grant access to selected accounts instead of every account in the file, replace the final line with:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Require user alice bobThis is more precise for a small, fixed list, but the directive must be updated when membership changes.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Use a group for a changing team
Apache can also authorize a group defined in a group file:
AuthGroupFile /etc/apache2/.htgroup-private
Require group editorsA group-file entry conventionally maps a group name to one or more usernames, for example:
editors: alice bobUse the group approach when several protected locations share team membership. Keep the group file outside the public tree and protect it like the password file. The exact authorization modules and package names vary by distribution; if Apache reports that a directive is unavailable, check that the corresponding authorization support is loaded.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Keep the PHP-FPM mapping intact
Authentication does not require a special PHP-FPM setting. Your existing Apache-to-FastCGI configuration should continue to route authorized .php requests. Apache documents both TCP and Unix-socket forms; a conceptual TCP mapping might look like:
ProxyPassMatch "^/app/.*\.php$" "fcgi://127.0.0.1:9000/var/www/app/"This is illustrative, not a drop-in path. Use the mapping supplied by your operating system or hosting setup, including its actual socket, pool, URI pattern, and document path. Do not alter a working PHP-FPM mapping merely to add Basic Authentication.
Apply the protection to the directory that contains the PHP entry points or to the appropriate parent directory. Apache evaluates the authentication rules before the FastCGI handler, so a request with no credentials should stop at the Apache challenge rather than execute application code.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Use HTTPS for any sensitive protected area
Basic Authentication does not provide confidentiality for the credentials or the response. The credential value is encoded for transport, not encrypted. Serve the protected URL over HTTPS with a valid certificate and redirect HTTP to HTTPS before users submit credentials.
Ensure the challenge is issued by the HTTPS virtual host. A redirect from HTTP to HTTPS is useful, but do not configure the login prompt only on an HTTP virtual host and assume the redirect itself protects the exchange. Test the final HTTPS URL directly and confirm that protected content is never returned over plain HTTP.
Test the setup in a controlled sequence
- Identify the virtual host. Request the exact hostname that should serve the directory. If DNS, a default virtual host, or a proxy sends the request elsewhere, the intended rules may never be read.
- Test without credentials. Open a protected URL in a private browser window or use a client that sends no
Authorizationheader. Apache should return a401 Unauthorizedresponse and a Basic-authentication challenge. - Test a valid account. Enter a username and password present in the referenced
htpasswdfile. The protected index or PHP page should load normally. - Test an invalid password. Use a real username with a wrong password. Apache should challenge or reject the request; the PHP script should not be allowed to run for that request.
- Test a PHP URL. Request a PHP file inside the protected directory after authenticating. This confirms that the authentication rule and the PHP-FPM handler work together.
- Test a non-PHP asset. Request an image, stylesheet, or text file in the same directory. Unless another rule exempts it, it should use the same protection.
- Clear cached credentials when retesting. Browsers can cache Basic-auth credentials for a realm. Use a private window or clear the browser’s authentication state when changing users or passwords.
Troubleshoot a login that does not work
| Symptom | Likely cause | What to check |
|---|---|---|
| The page loads without a prompt. | The request is reaching a different virtual host or directory, or overrides are disabled. | Confirm the hostname, filesystem directory, and the applicable AllowOverride AuthConfig rule. Check whether a parent or child configuration changes access. |
| Apache reports “not allowed here.” | The directive is not permitted in .htaccess. |
Enable an override class containing authentication directives, or move the rules into the main <Directory> configuration. |
| Apache says the password file is missing. | AuthUserFile contains a wrong path, a typo, or a URL path. |
Use the exact absolute path on disk and verify that the file exists on the server where Apache runs. |
| The prompt appears, but every valid password fails. | The wrong password file is referenced, the account was overwritten, or Apache cannot read the file. | Inspect the file path, recreate or update the account without -c, and check ownership and permissions. |
Apache returns a server error after adding .htaccess. |
A module or directive is unavailable, or the file contains a syntax error. | Read the Apache error log, confirm Basic Authentication and file-provider support are loaded, and check spelling and quoting. |
| HTML works but PHP does not. | The FastCGI mapping, PHP-FPM socket, or file path is wrong independently of authentication. | First authenticate successfully, then inspect the existing PHP-FPM mapping and PHP-FPM service logs. Do not replace a distribution-specific mapping with the illustrative example. |
| Users still see an old account after a password change. | The browser cached credentials for the realm. | Close the private session, clear cached authentication credentials, or change the realm temporarily while testing. |
| Credentials appear in an insecure connection. | The protected URL is being served over HTTP. | Install and enable TLS, redirect HTTP to HTTPS, and verify the challenge on the HTTPS virtual host. |
The Apache error log is the most useful place to distinguish a rejected override, unreadable password file, missing module, and unrelated PHP-FPM failure. Check the log for the same timestamp as your test request.
.htaccess versus main Apache configuration
| Consideration | .htaccess |
Main <Directory> configuration |
|---|---|---|
| Administrative access | Works when you can edit a directory but not the virtual-host configuration. | Requires server or virtual-host administration. |
| Performance | Apache performs distributed-configuration checks while processing requests. | Rules are centralized and avoid the same per-request directory-file overhead. |
| Scope and governance | Directory owners can deploy local rules, subject to the enabled override class. | Administrators retain a single, explicit policy for the site. |
| Deployment on shared hosting | Often the only available method. | Usually unavailable to shared-hosting customers. |
| Preferred choice when both are available | Use for delegated or unavoidable per-directory control. | Preferred for authentication that you administer centrally. |
Moving a working rule from .htaccess to a <Directory> block can improve operational clarity, but the filesystem path, password-file permissions, HTTPS policy, and user-selection rules still need to be correct.
Quick Recap
Operational practices that prevent avoidable failures
- Use an absolute password-file path. Relative paths and URL-style paths make deployments fragile and can point Apache at a different location than intended.
- Keep one account per person. Individual accounts make it possible to remove one person’s access without changing everyone else’s password.
- Prefer least privilege. Choose
Require userorRequire groupwhen only a subset of password-file accounts should enter. - Protect configuration backups. Copies of
.htaccess, password files, and group files can disclose usernames, paths, or access policy. - Use a descriptive realm. A clear
AuthNamehelps users identify which credentials are being requested and helps administrators recognize browser credential caches. - Do not rely on authentication as application authorization. Basic Authentication controls entry to the HTTP directory. A PHP application may still need its own roles, permissions, and session controls after a user is admitted.
- Check inherited rules. Parent directories, virtual-host blocks, and additional
.htaccessfiles can combine or override behavior. Test the exact URL and directory hierarchy users will access.
Configuration checklist
- The requested hostname reaches the intended Apache virtual host.
- The
.htaccessfile is in the directory that must be protected. - The relevant directory permits
AllowOverride AuthConfigor a broader override. - The four required directives are present:
AuthType,AuthName,AuthUserFile, andRequire. - The password file was created with
htpasswd, and additional accounts were added without-c. - Apache can read the password file, while web users cannot download or modify it.
- The PHP-FPM mapping remains the deployment’s existing, working mapping.
- The protected URL and login challenge are served over HTTPS.
- Unauthenticated, valid, invalid, and PHP requests have all been tested, with browser credential caching accounted for.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
