In some situations, you may want to restrict access to a specific page or directory on a website. Password protection can prevent unauthorised users from accessing sensitive content and can also help prevent unwanted access by automated users or bots.<\/p>\n\n\n\n
This guide explains how to configure HTTP Basic Authentication<\/strong> on an Nginx web server running on Ubuntu.<\/p>\n\n\n\n If Nginx is not installed on the server, refer to the related Nginx installation article mentioned below.<\/p>\n\n\n\n Before implementing password protection, make sure you have:<\/p>\n\n\n\n In this example, assume that the The directory is:<\/p>\n\n\n\n If there is only one domain on the server, the Nginx configuration file is:<\/p>\n\n\n\n For a domain-specific configuration, edit the appropriate Nginx virtual host configuration file instead.<\/p>\n\n\n\n Open the Nginx configuration file:<\/p>\n\n\n\n Add the following configuration inside the The In this example, the password file is:<\/p>\n\n\n\n You can store the The If the command is not available, install the Create the password file and add a user:<\/p>\n\n\n\n You will be prompted to enter and confirm the password:<\/p>\n\n\n\n Note:<\/strong> The original configuration points Nginx to Before restarting Nginx, check the configuration for syntax errors:<\/p>\n\n\n\n A successful configuration test should return output similar to:<\/p>\n\n\n\n Restart Nginx to apply the configuration:<\/p>\n\n\n\n Open the following URL in your browser:<\/p>\n\n\n\n The browser will display an authentication prompt requesting the configured username and password.<\/p>\n\n\n\n After providing valid credentials, the protected page will become accessible.<\/p>\n\n\n\n Nginx HTTP Basic Authentication provides a simple way to restrict access to specific website directories. By configuring For sensitive applications, use HTTPS so that credentials are not transmitted over an unencrypted HTTP connection.<\/p>\n\n\n\n Nginx Basic Authentication is an HTTP authentication mechanism that requires users to provide a username and password before accessing a protected location.<\/p>\n\n\n\n The Run:<\/p>\n\n\n\n This checks the Nginx configuration for syntax errors before you restart or reload the service.<\/p>\n\n\n\n Yes. The Basic Authentication should be used with HTTPS<\/strong>. Without HTTPS, the credentials are not adequately protected during transmission.<\/p>\n\n\n\nPrerequisites<\/h2>\n\n\n\n
\n
sudo<\/code> access.<\/li>\n\n\n\n\/etc\/nginx<\/code>.<\/li>\n\n\n\nImplementation<\/h2>\n\n\n\n
Step 1: Identify the Directory to Protect<\/h3>\n\n\n\n
web<\/code> folder needs to be protected with a username and password.<\/p>\n\n\n\n\/var\/www\/html\/web<\/pre>\n\n\n\n
\/etc\/nginx\/sites-enabled\/default<\/pre>\n\n\n\n
Step 2: Edit the Nginx Configuration<\/h3>\n\n\n\n
vi \/etc\/nginx\/sites-enabled\/default<\/pre>\n\n\n\n
server {}<\/code> block:<\/p>\n\n\n\nlocation \/web\/ {\n auth_basic \"Restricted Content\";\n auth_basic_user_file \/var\/www\/html\/web\/.htpasswd;\n}<\/pre>\n\n\n\nauth_basic<\/code> directive enables password authentication, while auth_basic_user_file<\/code> specifies the file containing the authentication credentials.<\/p>\n\n\n\n\/var\/www\/html\/web\/.htpasswd<\/pre>\n\n\n\n
.htpasswd<\/code> file in another location if you prefer to keep it outside the document root.<\/p>\n\n\n\nStep 3: Install htpasswd<\/h3>\n\n\n\n
htpasswd<\/code> command is used to create and manage the password file.<\/p>\n\n\n\napache2-utils<\/code> package:<\/p>\n\n\n\napt-get install apache2-utils<\/pre>\n\n\n\n
Step 4: Create the Password File<\/h3>\n\n\n\n
htpasswd -c \/var\/www\/html\/.htpasswd username<\/pre>\n\n\n\n
New password:\nRe-type new password:\nAdding password for user username<\/pre>\n\n\n\n
\n
\/var\/www\/html\/web\/.htpasswd<\/code>, while the example htpasswd<\/code> command creates \/var\/www\/html\/.htpasswd<\/code>. Make sure both paths match. For the configuration above, create the file at \/var\/www\/html\/web\/.htpasswd<\/code>, or update auth_basic_user_file<\/code> to the actual file location.<\/p>\n<\/blockquote>\n\n\n\nStep 5: Test the Nginx Configuration<\/h3>\n\n\n\n
nginx -t<\/pre>\n\n\n\n
nginx: the configuration file \/etc\/nginx\/nginx.conf syntax is ok\nnginx: configuration file \/etc\/nginx\/nginx.conf test is successful<\/pre>\n\n\n\n
Step 6: Restart Nginx<\/h3>\n\n\n\n
systemctl restart nginx<\/pre>\n\n\n\n
Step 7: Access the Protected Page<\/h3>\n\n\n\n
http:\/\/IPADDRESS\/web<\/pre>\n\n\n\n
Conclusion<\/h2>\n\n\n\n
auth_basic<\/code>, creating an .htpasswd<\/code> file, testing the Nginx configuration, and restarting the service, you can password-protect a particular URL or directory on an Ubuntu server.<\/p>\n\n\n\nFAQs<\/h2>\n\n\n\n
1. What is Nginx Basic Authentication?<\/h4>\n\n\n\n
2. What is the purpose of the
.htpasswd<\/code> file?<\/h4>\n\n\n\n.htpasswd<\/code> file stores the usernames and password hashes used by Nginx to authenticate users.<\/p>\n\n\n\n3. How can I check whether my Nginx configuration is valid?<\/h4>\n\n\n\n
nginx -t<\/pre>\n\n\n\n
4. Can I protect only one directory instead of the entire website?<\/h4>\n\n\n\n
location<\/code> block can be configured for a specific path, such as:<\/p>\n\n\n\nlocation \/web\/ {\n auth_basic \"Restricted Content\";\n auth_basic_user_file \/var\/www\/html\/web\/.htpasswd;\n}<\/pre>\n\n\n\n5. Is Basic Authentication secure?<\/h4>\n\n\n\n
Related Articles<\/h2>\n\n\n\n
\n
Read the article<\/a><\/li>\n\n\n\n
Read the article<\/a><\/li>\n<\/ul>\n\n\n\nTalk to our experts<\/h2>\n\n\n\n