HTTP status code 401 Unauthorized: causes and solutions

What does status code 401 mean?

The server knows the requested page but only releases it after successful authentication. Together with the status code, it sends the WWW-Authenticate header, which specifies how to authenticate. With classic directory protection, the browser then opens the familiar login dialog.

401 or 403 - what is the difference?

• 401 Unauthorized: you are not logged in or the credentials are wrong. With valid credentials you get access.
• 403 Forbidden: the server knows who you are but refuses access in principle - for example due to missing permissions, blocked IP addresses or a firewall rule.

Typical causes

• Directory protection (.htaccess + .htpasswd) protects the area, and the credentials are missing or wrong.
• The credentials were changed, but the browser still sends the old ones.
• The path to the .htpasswd in the .htaccess is incorrect, for example after moving the website.
• For applications and interfaces (APIs): an expired session, a missing or invalid API key or token.

Solution for visitors

• Check your user name and password - mind upper and lower case.
• Browsers remember directory protection credentials until they are closed. Close all browser windows or test in a private window.
• Log out of web applications once and log in again.
• If the error persists, contact the operator of the website.

Solution for site operators

The easiest way to set up directory protection is in the control panel: KeyHelp and Plesk both offer a directory protection feature. There you create protected folders and users without editing files yourself.

Alternatively, create the protection manually. The .htaccess in the folder to protect:

AuthType Basic
AuthName "Protected area"
AuthUserFile /absolute/path/to/.htpasswd
Require valid-user

Create the .htpasswd via SSH with secure encryption (bcrypt):

htpasswd -c -B /absolute/path/to/.htpasswd username

You will then be asked for the password twice. Important: the option -c creates the file anew and overwrites an existing one. Therefore, add further users without -c:

htpasswd -B /absolute/path/to/.htpasswd another-user

Tips for secure directory protection

• Store the .htpasswd outside the publicly accessible web directory whenever possible.
• Only use directory protection over HTTPS - credentials are transmitted when logging in.
• Use separate credentials for each user and remove entries that are no longer needed.
• Directory protection is well suited as additional protection for test and staging environments or admin areas.

Related status codes

• 404 Not Found - the page does not exist (anymore)
• 301 Moved Permanently - the page has moved permanently

You can find failed login attempts in the logs of your website: How do I read my log files?