One place for hosting & domains

      How To Set Up Password Authentication with Apache on Ubuntu 18.04 [Quickstart]


      This tutorial will walk you through password-protecting assets on an Apache web server running on Ubuntu 18.04. Completing these steps will provide your server with additional security so that unauthorized users cannot access certain parts of your page.

      For a more detailed version of this tutorial, with more detailed explanations of each step, please refer to How To Set Up Password Authentication with Apache on Ubuntu 18.04.


      In order to complete this tutorial, you will need access to the following on an Ubuntu 18.04 server:

      Step 1 — Install the Apache Utilities Package

      We’ll install a utility called htpasswd, part of the apache2-utils package to manage usernames and passwords with access to restricted content.

      • sudo apt-get update
      • sudo apt-get install apache2-utils

      Step 2 — Create the Password File

      We’ll create the first user as follows (replace `first_username with username of your choice):

      • sudo htpasswd -c /etc/apache2/.htpasswd first_username

      You will be asked to supply and confirm a password for the user.

      Leave out the -c argument for any additional users you wish to add so you don’t overwrite the file:

      • sudo htpasswd /etc/apache2/.htpasswd another_user

      Step 3 — Configure Apache Password Authentication

      In this step, we need to configure Apache to check this file before serving our protected content. We will do this by using the site’s virtual host file, but there is another option detailed in the longer tutorial if you don’t have access or prefer to use .htaccess files instead.

      Open up the virtual host file that you wish to add a restriction to with a text editor such as nano:

      • sudo nano /etc/apache2/sites-enabled/default-ssl.conf

      Authentication is done on a per-directory basis. In our example, we’ll restrict the entire document root, but you can modify this listing to only target a specific directory within the web space.

      In this step, add the following highlighted lines in your file:


      <VirtualHost *:80>
        ServerAdmin webmaster@localhost
        DocumentRoot /var/www/html
        ErrorLog ${APACHE_LOG_DIR}/error.log
        CustomLog ${APACHE_LOG_DIR}/access.log combined
        <Directory "/var/www/html">
            AuthType Basic
            AuthName "Restricted Content"
            AuthUserFile /etc/apache2/.htpasswd
            Require valid-user

      Check the configuration with the following command:

      You can restart the server to implement your password policy, and then check the status of your server.

      • sudo systemctl restart apache2
      • sudo systemctl status apache2

      Step 4 — Confirm Password Authentication

      To confirm that your content is protected, try to access your restricted content in a web browser. You should be presented with a username and password prompt:

      Apache2 password prompt

      Here are links to more detailed guides related to this tutorial:

      Source link