{"id":17743,"date":"2026-10-15T09:54:39","date_gmt":"2026-10-15T04:24:39","guid":{"rendered":"https:\/\/www.skynats.com\/blog\/?p=17743"},"modified":"2026-10-15T09:54:39","modified_gmt":"2026-10-15T04:24:39","slug":"how-to-set-up-password-authentication-with-apache-on-ubuntu","status":"publish","type":"post","link":"https:\/\/www.skynats.com\/blog\/how-to-set-up-password-authentication-with-apache-on-ubuntu\/","title":{"rendered":"How to Set Up Password Authentication with Apache on Ubuntu"},"content":{"rendered":"<p><strong>Apache Basic Authentication on Ubuntu<\/strong> is a simple and effective way to password-protect websites, directories, staging environments, and internal applications from unauthorized access.<\/p>\n<p>Apache HTTP Server is one of the most widely used web servers for hosting websites and applications on <span style=\"color: #999999;\"><a style=\"color: #999999;\" href=\"https:\/\/ubuntu.com\/\" target=\"_blank\" rel=\"noopener\">Ubuntu<\/a><\/span>. Using HTTP Basic Authentication with Apache&#8217;s <code>mod_auth_basic<\/code> module and an <code>.htpasswd<\/code> file, you can require visitors to enter a valid username and password before accessing protected content.<\/p>\n<p>In this guide, you&#8217;ll learn how to configure Apache Basic Authentication on Ubuntu, create users with <span style=\"color: #333333;\"><code>htpasswd<\/code><\/span>, protect your website or directory, and test the authentication setup.<\/p>\n<h2 data-pm-slice=\"1 1 []\">How Apache Basic Authentication Works<\/h2>\n<p>To enable <strong>Apache Basic Authentication on Ubuntu<\/strong>, enable the <code>auth_basic<\/code> and <code>authn_file<\/code> modules, create an <code>.htpasswd<\/code> file using the <code>htpasswd<\/code> command, and configure <code>AuthType Basic<\/code>, <code>AuthUserFile<\/code>, and <code>Require valid-user<\/code> inside the appropriate Apache <code>&lt;Directory&gt;<\/code> block. Test the configuration with <code>apache2ctl configtest<\/code>, then reload Apache. Users will then be required to enter a valid username and password before accessing the protected website or directory.<\/p>\n<h2><b>Prerequisites<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Before getting started, make sure you have:<\/span><\/p>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A server with Apache installed.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">A website or directory that you want to protect.<\/span><\/li>\n<\/ul>\n<p><strong>Security Note:<\/strong> HTTP Basic Authentication should be used over HTTPS because Basic Authentication does not encrypt credentials by itself. SSL\/TLS protects the username and password while they are transmitted between the browser and server.<\/p>\n<h2><b>Step 1: Enable Apache Authentication Modules<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Apache provides Basic Authentication through the <\/span><span style=\"font-weight: 400;\">mod_auth_basic<\/span><span style=\"font-weight: 400;\"> module. You also need <\/span><span style=\"font-weight: 400;\">mod_authn_file<\/span><span style=\"font-weight: 400;\"> to authenticate users against a password file.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Enable both modules:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo a2enmod auth_basic<\/span><\/p>\n<p><span style=\"font-weight: 400;\">sudo a2enmod authn_file<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">Then reload Apache:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo systemctl reload apache2<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">You can verify that the modules are loaded with:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">apache2ctl -M | grep auth<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">You should see entries similar to:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">auth_basic_module<\/span><\/p>\n<p><span style=\"font-weight: 400;\">authn_file_module<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><b>Step 2: Create a Password File<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Apache uses the <\/span><span style=\"font-weight: 400;\">htpasswd<\/span><span style=\"font-weight: 400;\"> utility to create and manage usernames and passwords. The utility is included in the <\/span><span style=\"font-weight: 400;\">apache2-utils<\/span><span style=\"font-weight: 400;\"> package. Install it:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo apt install apache2-utils<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">Now create a password file and add your first user:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo htpasswd -c \/etc\/apache2\/.htpasswd user1<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">You&#8217;ll be prompted to enter and confirm a password:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">New password:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Re-type new password:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Adding password for user admin<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">If you want to add another user later, omit the <\/span><span style=\"font-weight: 400;\">-c<\/span><span style=\"font-weight: 400;\"> option:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo htpasswd \/etc\/apache2\/.htpasswd user2<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">You can check the users stored in the file with:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo cat \/etc\/apache2\/.htpasswd<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">The passwords aren&#8217;t stored as plain text. The file contains usernames and password hashes.<\/span><\/p>\n<h2><b>Step 3: Edit the Apache Virtual Host<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Open the appropriate Virtual Host configuration:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo vim \/etc\/apache2\/sites-available\/example.com.conf<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">To require a username and password before anyone can access the site, modify the <\/span><span style=\"font-weight: 400;\">&lt;Directory&gt;<\/span><span style=\"font-weight: 400;\"> block:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">&lt;Directory \/var\/www\/example.com&gt;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0Options Indexes FollowSymLinks<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0AllowOverride None<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0AuthType Basic<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0AuthName &#8220;Restricted Area&#8221;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0AuthUserFile \/etc\/apache2\/.htpasswd<\/span><\/p>\n<p><span style=\"font-weight: 400;\">\u00a0\u00a0\u00a0\u00a0Require valid-user<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&lt;\/Directory&gt;<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">Multiple users can be specified as :<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">Require user user1 user2<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><b>Step 4: Test the Apache Configuration<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Before reloading Apache, check the configuration for syntax errors:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo apache2ctl configtest<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">A successful configuration should return:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Syntax OK<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Once the configuration passes the syntax check, reload Apache:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">sudo systemctl restart apache2<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h2><b>Step 5: Test Password Authentication<\/b><\/h2>\n<p><span style=\"font-weight: 400;\">Open your website in a browser:<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">http:\/\/example.com<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">Instead of immediately displaying the website, Apache should request a username and password. Enter the credentials created earlier:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Username: user1<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Password: your-password<\/span><\/p>\n<p><span style=\"font-weight: 400;\">After successful authentication, Apache should allow access to the website.<\/span><\/p>\n<h2>Conclusion<\/h2>\n<p>Setting up <strong>Apache Basic Authentication on Ubuntu<\/strong> is a simple and effective way to protect private websites, staging environments, administrative areas, and sensitive directories from unauthorized access. By using Apache&#8217;s <code>mod_auth_basic<\/code> module together with an <code>.htpasswd<\/code> file, you can add an extra layer of access control without building a separate login system.<\/p>\n<p>For production environments, always use Basic Authentication with HTTPS and follow recommended <a href=\"https:\/\/www.skynats.com\/blog\/installing-apache-pulsar-on-ubuntu-24\/\">Apache server<\/a> security and <a href=\"https:\/\/www.skynats.com\/web-server-hardening\">web server hardening<\/a> practices to reduce potential security risks.<\/p>\n<h3>Need Help Securing or Managing Your Apache Server?<\/h3>\n<p>Apache security involves more than password protection. Incorrect permissions, outdated modules, weak SSL\/TLS settings, and improper server configurations can leave your website vulnerable.<\/p>\n<p>Skynats provides <a href=\"https:\/\/www.skynats.com\/server-management\">professional Apache server management<\/a>, Linux server administration, security hardening, monitoring, and <a href=\"https:\/\/www.skynats.com\/web-server-optimization\">performance optimization<\/a> to help keep your server secure and reliable.<\/p>\n<p>\u2192 Get <a href=\"https:\/\/www.skynats.com\/contact-us\">Expert Apache Server Support<\/a><br \/>\n\u2192 Explore <a href=\"https:\/\/www.skynats.com\/web-server-hardening\">Web Server Hardening Services<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Apache Basic Authentication on Ubuntu is a simple and effective way to password-protect websites, directories, staging environments, and internal applications from unauthorized access. Apache HTTP Server is one of the most widely used web servers for hosting websites and applications on Ubuntu. Using HTTP Basic Authentication with Apache&#8217;s mod_auth_basic module and an .htpasswd file, you [&hellip;]<\/p>\n","protected":false},"author":14,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[5],"tags":[],"class_list":["post-17743","post","type-post","status-publish","format-standard","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/17743","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/users\/14"}],"replies":[{"embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/comments?post=17743"}],"version-history":[{"count":3,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/17743\/revisions"}],"predecessor-version":[{"id":17746,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/posts\/17743\/revisions\/17746"}],"wp:attachment":[{"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/media?parent=17743"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/categories?post=17743"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.skynats.com\/blog\/wp-json\/wp\/v2\/tags?post=17743"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}