Apache Basic Authentication on Ubuntu is a simple and effective way to password-protect websites, directories, staging environments, and internal applications from unauthorized access.
Apache HTTP Server is one of the most widely used web servers for hosting websites and applications on Ubuntu. Using HTTP Basic Authentication with Apache’s mod_auth_basic module and an .htpasswd file, you can require visitors to enter a valid username and password before accessing protected content.
In this guide, you’ll learn how to configure Apache Basic Authentication on Ubuntu, create users with htpasswd, protect your website or directory, and test the authentication setup.
How Apache Basic Authentication Works
To enable Apache Basic Authentication on Ubuntu, enable the auth_basic and authn_file modules, create an .htpasswd file using the htpasswd command, and configure AuthType Basic, AuthUserFile, and Require valid-user inside the appropriate Apache <Directory> block. Test the configuration with apache2ctl configtest, then reload Apache. Users will then be required to enter a valid username and password before accessing the protected website or directory.
Prerequisites
Before getting started, make sure you have:
- A server with Apache installed.
- A website or directory that you want to protect.
Security Note: HTTP Basic Authentication should be used over HTTPS because Basic Authentication does not encrypt credentials by itself. SSL/TLS protects the username and password while they are transmitted between the browser and server.
Step 1: Enable Apache Authentication Modules
Apache provides Basic Authentication through the mod_auth_basic module. You also need mod_authn_file to authenticate users against a password file.
Enable both modules:
| sudo a2enmod auth_basic
sudo a2enmod authn_file |
Then reload Apache:
| sudo systemctl reload apache2 |
You can verify that the modules are loaded with:
| apache2ctl -M | grep auth |
You should see entries similar to:
| auth_basic_module
authn_file_module |
Step 2: Create a Password File
Apache uses the htpasswd utility to create and manage usernames and passwords. The utility is included in the apache2-utils package. Install it:
| sudo apt install apache2-utils |
Now create a password file and add your first user:
| sudo htpasswd -c /etc/apache2/.htpasswd user1 |
You’ll be prompted to enter and confirm a password:
| New password:
Re-type new password: Adding password for user admin |
If you want to add another user later, omit the -c option:
| sudo htpasswd /etc/apache2/.htpasswd user2 |
You can check the users stored in the file with:
| sudo cat /etc/apache2/.htpasswd |
The passwords aren’t stored as plain text. The file contains usernames and password hashes.
Step 3: Edit the Apache Virtual Host
Open the appropriate Virtual Host configuration:
| sudo vim /etc/apache2/sites-available/example.com.conf |
To require a username and password before anyone can access the site, modify the <Directory> block:
| <Directory /var/www/example.com>
Options Indexes FollowSymLinks AllowOverride None AuthType Basic AuthName “Restricted Area” AuthUserFile /etc/apache2/.htpasswd Require valid-user </Directory> |
Multiple users can be specified as :
| Require user user1 user2 |
Step 4: Test the Apache Configuration
Before reloading Apache, check the configuration for syntax errors:
| sudo apache2ctl configtest |
A successful configuration should return:
Syntax OK
Once the configuration passes the syntax check, reload Apache:
| sudo systemctl restart apache2 |
Step 5: Test Password Authentication
Open your website in a browser:
| http://example.com |
Instead of immediately displaying the website, Apache should request a username and password. Enter the credentials created earlier:
Username: user1
Password: your-password
After successful authentication, Apache should allow access to the website.
Conclusion
Setting up Apache Basic Authentication on Ubuntu is a simple and effective way to protect private websites, staging environments, administrative areas, and sensitive directories from unauthorized access. By using Apache’s mod_auth_basic module together with an .htpasswd file, you can add an extra layer of access control without building a separate login system.
For production environments, always use Basic Authentication with HTTPS and follow recommended Apache server security and web server hardening practices to reduce potential security risks.
Need Help Securing or Managing Your Apache Server?
Apache security involves more than password protection. Incorrect permissions, outdated modules, weak SSL/TLS settings, and improper server configurations can leave your website vulnerable.
Skynats provides professional Apache server management, Linux server administration, security hardening, monitoring, and performance optimization to help keep your server secure and reliable.
→ Get Expert Apache Server Support
→ Explore Web Server Hardening Services
