Setting up directory protection with .htaccess

What is directory protection?

Directory protection (also known as .htaccess protection or HTTP authentication) protects specific areas of your website with a username and password. When a protected directory is accessed, a login dialogue box appears in the browser - the content is only displayed once the login details have been successfully entered.

Typical use cases:

• Protecting the administration area: An additional layer of security for /wp-admin, /administrator or similar backend directories
• Staging or development sites: Prevent search engines or unauthorised visitors from accessing test environments
• Internal documents: Making confidential files accessible only to authorised persons
• Customer area: Simple protection for download areas or project documentation

Set up directory protection via KeyHelp (recommended)

The simplest method is to set this up directly via your KeyHelp Control Panel. This automatically creates the necessary files and configures them correctly.

Step 1: Open the directory protection management

1. Log in to the customer portal
2. Go to your chosen hosting plan -> Then log in to the web server management panel
3. Navigate to Security → Directory Protection
4. Click on the ‘Add directory protection’ button

Step 2: Configure protection

Enter the following details in the form:

Tip: Use the ‘Generate’ button next to the password field to create a secure, random password. Make a note of your login details and keep them in a safe place.

Step 3: Save and test

1. Click on ‘Save’
2. Protection is active immediately
3. Test access by opening the protected directory in your browser

Define exceptions (optional)

You can use the ‘Define exceptions’ link to exclude specific files or subdirectories from protection. This is useful, for example, if WordPress AJAX requests need to /wp-admin/admin-ajax.php need to work without authentication.

Setting up directory protection manually

Alternatively, you can also configure directory protection manually using .htaccess files. This method offers greater flexibility but requires technical knowledge.

Files required

For manual directory protection, you will need two files:

Step 1: Create the .htpasswd file

The .htpasswd file contains the login details. The password is stored in encrypted form.

Important: Save the .htpasswd file outside the publicly accessible web directory (/www). A secure location would be, for example:

/home/users/IHR-BENUTZERNAME/.htpasswd

Format of the .htpasswd file:

benutzername:verschluesseltes_passwort

Encrypting the password:

You can encrypt the password via the command line (SSH) or using an online generator. Via SSH:

htpasswd -c /home/users/IHR-BENUTZERNAME/.htpasswd benutzername

Alternatively, you can use an online htpasswd generator and manually insert the result into the file.

Example of an .htpasswd file:

admin:$apr1$xyz12345$abcdefghijklmnop123456

Step 2: Create an .htaccess file

In the directory you wish to protect, create an .htaccessfile with the following content:

AuthType Basic
AuthName "Geschützter Bereich"
AuthUserFile /home/users/IHR-BENUTZERNAME/.htpasswd
Require valid-user

Explanation of the directives:

Step 3: Check permissions

Ensure that the file permissions are set correctly:

• .htaccess: 644 (readable by everyone, writable only by the owner)
• .htpasswd: 640 or 644 (readable by the web server)

Advanced configurations

Adding multiple users

You can define multiple users in the .htpasswd file - one per line:

admin:$apr1$xyz12345$abcdefghijklmnop123456
mitarbeiter:$apr1$abc67890$qrstuvwxyz789012345
kunde:$apr1$def11111$lmnopqrstuvwxyz12345

Allow only specific users

Instead of Require valid-user you can also specify individual users explicitly:

AuthType Basic
AuthName "Admin-Bereich"
AuthUserFile /home/users/IHR-BENUTZERNAME/.htpasswd
Require user admin mitarbeiter

Exclude specific files from protection

To exclude individual files (e.g. for AJAX requests) from protection:

AuthType Basic
AuthName "Geschützter Bereich"
AuthUserFile /home/users/IHR-BENUTZERNAME/.htpasswd
Require valid-user

# Ausnahme für admin-ajax.php
<Files "admin-ajax.php">
    Satisfy Any
    Allow from all
</Files>

Apply additional IP address restrictions

You can restrict access to specific IP addresses - either in addition to password protection or as the sole restriction:

# Nur bestimmte IPs dürfen zugreifen (ohne Passwort)
Order Deny,Allow
Deny from all
Allow from 192.168.1.100
Allow from 10.0.0.0/24

Or in combination with password protection:

AuthType Basic
AuthName "Geschützter Bereich"
AuthUserFile /home/users/IHR-BENUTZERNAME/.htpasswd
Require valid-user

# Zusätzlich nur von bestimmten IPs
Order Deny,Allow
Deny from all
Allow from 192.168.1.100
Satisfy All

Security notes

Please note the following important security considerations when using directory protection:

⚠️ HTTP Basic Authentication is not encrypted

HTTP Basic Authentication transmits login credentials only in Base64-encoded form - not encrypted. Without HTTPS, login credentials can be intercepted.

Important: Always use directory protection in conjunction with HTTPS. All SpeedIT hosting packages include free SSL certificates - ensure that your site is accessible exclusively via HTTPS.

⚠️ Store the .htpasswd file outside the web directory

Never store the .htpasswd file in the publicly accessible /wwwdirectory. Although the web server normally blocks direct access to files beginning with a full stop, it is safer to store the file outside the web root.

⚠️ Use secure passwords

Use strong, unique passwords:

• At least 12 characters
• A combination of upper- and lower-case letters, numbers and special characters
• No dictionary words or personal information
• Use the password generator in KeyHelp

⚠️ Directory protection is no substitute for application security

.htaccess protection provides an additional layer of security, but does not replace:

• Secure passwords within the application itself (e.g. WordPress admin)
• Regular updates to the CMS, plugins and themes
• Further security measures such as two-factor authentication

Common problems and solutions

500 Internal Server Error after setup

Possible causes:

• Syntax error in the .htaccess file
• Incorrect path to the .htpasswd file
• Missing or incorrect permissions

Solution:

• Check the .htaccess file for typos
• Ensure that the path in AuthUserFile is an absolute path
• Check the file permissions
• Check the error log for details → Analyse error logs

The login dialogue does not appear

Possible causes:

• The .htaccess file is not being read
• File name is misspelt (note the full stop at the start!)
• The .htaccess file exists in a parent directory and is overriding the settings

Solution:

• Ensure that the file is named exactly .htaccess (with a full stop at the start)
• Check whether a .htaccess file exists in the parent directory

Login fails despite correct details

Possible causes:

• The password has not been encrypted correctly
• The path to the .htpasswd file is incorrect
• Special characters in the password are causing problems

Solution:

• Recreate the .htpasswd file using the KeyHelp tool or htpasswdcommand
• Avoid special characters such as $, " or \ in the password
• Test with a simple password for debugging purposes

WordPress functions disrupted (e.g. AJAX)

If you /wp-admin enable this, certain WordPress functions (AJAX, Customiser) may no longer work.

Solution: Add an exception for admin-ajax.php (see the section ‘Exclude specific files from protection’) or use the exceptions feature in KeyHelp.

Related articles

• ModSecurity - your shield against cyber attacks
• Server not accessible / IP block
• Fixing a 500 Internal Server Error
• Security in our hosting

Need help?

If you’re having problems setting up directory protection, please contact our support team. We’ll be happy to help - including via remote support.

Contact support