In this blog post, we will provide detail instructions on how to protect your Joomla! /administrator/ directory on Apache servers using the htpasswd utility. You can easily adapt these instructions to protect other directories. If you need help finding or creating your .htaccess file, start here.

Caveat (From Apache.org)

Basic authentication should not be considered secure for any particularly rigorous definition of secure. Although the password is stored on the server in encrypted format, it is passed from the client to the server in plain text across the network. Anyone listening with any variety of packet sniffer will be able to read the username and password in the clear as it goes across.

Not only that, but remember that the username and password are passed with every request, not just when the user first types them in. So the packet sniffer need not be listening at a particularly strategic time, but just for long enough to see any single request come across the wire.

And, in addition to that, the content itself is also going across the network in the clear, and so if the web site contains sensitive information, the same packet sniffer would have access to that information as it went past, even if the username and password were not used to gain direct access to the web site.

Don't use basic authentication for anything that requires real security. It is a detriment for most users, since very few people will take the trouble, or have the necessary software and/or equipment, to find out passwords. However, if someone had a desire to get in, it would take very little for them to do so.

Basic authentication across an SSL connection, however, will be secure, since everything is going to be encrypted, including the username and password.

Directions

  1. If you are unfamiliar with the Apache htpasswd utility, you may want to read the following link first. Apache Authentication, Authorization, and Access Control
  2. Check to be sure your site is configured to use .htaccess files. If not sure, ask your host.
  3. Decide where to put your .htaccess file. Because Apache recursively searches all directories in a path for .htaccess files, the higher in your directory structure you place this file, the more directories it will control. If there is already an .htaccess file in the directory you choose, it's probably best to add the new code to it.
  4. Decide where to store your.htpasswd and .htgroups files. These files should NEVER be publicly accessable through the Web. Below is an example directory structure showing good locations for each file. Note that the /auth/ directory in this example is NOT accessible from the Web.
    • /home/mysite/public_html/.htaccess
    • /home/mysite/auth/.htpasswd/
    • /home/mysite/auth/.htgroups/
  5. Create the .htpasswd and .htgroups files as explained in the official Apache HowTo, referenced above. (Since you've read the always current and official documentation at Apache.org, we'll spare you the trouble of displaying it again here.)
  6. If a .htaccess file already exists in the directory you have chosen, make a backup copy. If the file does not exist, create a new file with that name now. (Don't forget the dot at the beginning of the name.)
  7. Add the following code to the .htaccess file. Adjust the example paths (marked in red) as needed for your server. Adjust the group name that you created in step 5 if it differs from the below example.
    AuthUserFile /home/auth/.htpasswd
    AuthGroupFile /home/auth/.htgroups
    AuthType Basic
    AuthName "LWS"
    require group admins
    
  8. Test carefully.
  9. Remove all backup .htaccess files from public_http directories.

If you can not use the Apache htpasswd utility, here's a free, online script that creates the necessary files for you. You'll need to know the user name, password, and path. The script does the rest for you. Note that for more advanced configuration, such as the use of groups, you'll need to edit the resulting files.

.htaccess Generator: https://www.htaccessredirect.net/


Comments (43)

Personalized quotes are a great way to express your feelings and to say so much more. They are also a great way to share with those who you love. For example, if your spouse has a special child, then you can give the gift of "Forever Your Love...

Personalized quotes are a great way to express your feelings and to say so much more. They are also a great way to share with those who you love. For example, if your spouse has a special child, then you can give the gift of "Forever Your Love “Merry Christmas" to tell your beloved that you'll always be there for them, no matter what.

Read More
  Attachments
 
  1. Kim John

Thanks for sharing.

  Attachments
 

Try not to utilize fundamental validation for anything that requires genuine security. It is a hindrance for most clients, since not many individuals will take the difficulty.

  Attachments
 
  1. Christie Brown

I think this is an educational post and it is helpful and proficient. accordingly, I might want to thank you for the endeavours you have made ShopCelebsWear recorded as a hard copy this article.

  Attachments
 

We are Dubai based established SIRA CCTV Approved Company Dubai. LOGICAL NETWORK SOLUTION CCTV Company Dubai offers a comprehensive solution for CCTV services, maintenance as well as installation. Our staffs have enough knowledge that are 24/7...

We are Dubai based established SIRA CCTV Approved Company Dubai. LOGICAL NETWORK SOLUTION CCTV Company Dubai offers a comprehensive solution for CCTV services, maintenance as well as installation. Our staffs have enough knowledge that are 24/7 available on your door step.

Read More
  Attachments
 

Get Door access control system Dubai or Biometric door access control system Dubai by Tawdeeh Technical Services at an affordable price. We are the Dubai based IT support company that provides quality door access control system service with peace...

Get Door access control system Dubai or Biometric door access control system Dubai by Tawdeeh Technical Services at an affordable price. We are the Dubai based IT support company that provides quality door access control system service with peace of mind.

Read More
  Attachments
 
  1. interior design dubai

To get convenient service of interior design Dubai. Look at DECO WOOD DECORATION LLC interior design Company Dubai that offers a satisfying service with the best job. We also answer any question in a short time. To any inquiry touch us.

  Attachments
 
  1. pikachu chu

The World Health Organization recommends that coronavirus is currently very complex, so prevent it by wearing a mask and washing your hands regularly to limit disease. atari breakout

  Attachments
 
  1. TV repair Dubai

TVrepair.ae can be repaired and maintained effectively for TV repair Dubai service and you do not have to buy a new one. We are the TV repair company that offers a cost-effective way. We have experts who can find out why your appliance has failed...

TVrepair.ae can be repaired and maintained effectively for TV repair Dubai service and you do not have to buy a new one. We are the TV repair company that offers a cost-effective way. We have experts who can find out why your appliance has failed to perform a function. So don't worry about it. Just connect with us.

Read More
  Attachments
 

We are the best tile installation company in Dubai, we have a team of skilled professional who will install tiles perfectly into your
house, so don’t worry about the quality of work. Our company has years of experience in this renovation...

We are the best tile installation company in Dubai, we have a team of skilled professional who will install tiles perfectly into your
house, so don’t worry about the quality of work. Our company has years of experience in this renovation field<a href="https://fixhub.ae/tile-flooring/">Best tile installation company Dubai </a>

Read More
  Attachments
 
There are no comments posted here yet
Load More

Leave your comments

Posting comment as a guest.
Attachments (0 / 3)
Share Your Location

Custom Work Services

CmsBold provides best services to help you solve any stuff with your website, make it the leading in your industry.

Get FREE Quote Now!

Subscribe newsletter

Get our latest updates with exclusive news and offers in your inbox.