File path, .htpasswd file and directory privacy

Hosting Support
1

i want to know the file path address

how do I do that

2

The path in the browser, or the path on the server?

6 Likes
3

of the server, i want to make a .htpasswd file so I want to know the file path address to tell where it is stored

4

The root folder is the /htdocs folder

3 Likes
5

but how to know the exact destination
like in windows we can get it from the top bar
image

6

If you want the .htpasswd file to affect your entire website, you put it in the htdocs folder. That is the full path, just /htdocs

3 Likes
7

so writing this is correct (in .htaccess)
image

8

Where is your htaccess file stored? It should not be stored outside of the root folder, so that would not be correct.

If you don’t know how to set it up, you should let the system do it for you. In the control panel, there is an option called “Directory Privacy”, I think that is what you are looking for.

3 Likes
9

it is stored in a file in htdocs
not outside root folder

10

So then why does your file path include the root folder?

11

image
should it be like this?

12

No, you are still including the root folder

Try “/.htpasswd” or “.htpasswd”

3 Likes
13

see this is the home page(this .htaccess is not created by me, its by IF)
image

now inside htdocs is .htpasswd
image

and inside ‘site’ folder is mine .htaccess file
image

so I should write /htdocs/.htpasswd or just .htpasswd?

14

I don’t see any .htpasswd files. You can’t connect to a file that does not exist.

Why don’t you just use the “Directory Privacy” feature in the control panel?

6 Likes
15

though .htpasswd file is there
image

but ‘directory privacy’ did my work
thanks @Greenreader9

1 Like
16

but there is a probem with it, it just asks the username and pass once, I want that every time a person open that site it should enter the credentials

17

Yes, because once you enter the username and password it saves a cookie to your computer telling it that you already logged in. New users don’t have that cookie, so they have to login.

Also, securing a website with htaccess is a bad idea, since a brute force attack is really easy.

4 Likes
18

so whats the best way to secure it?

19

I don’t know if this is the best way, but how about securing the folder so that you need a username and password to go to it?

20

@akshayan, that is what the OP is trying to accomplish.

I have used AuthUserFiles before, so I’ll try to provide some guidance.
By far, the easiest way to set it up is via vPanel “Directory Privacy” feature.
However, if you don’t want to use that tool, I recommend generating your own .htpasswd file:

  1. Go to this .htpasswd generator and select Bcrypt from the selections at the bottom. Type in your username and password and click “generate”
  2. Copy the output to a new/blank file named .htpasswd
  3. Save/close .htpasswd, open your .htaccess. Type this:
ErrorDocument 401 "You are unauthorized to view this resource!"
ErrorDocument 403 "You do not have access to view this resource!"
RewriteEngine On
RewriteRule .htpasswd - [F]
AuthType Basic
AuthName "Please authenticate to view this resource"
AuthUserFile .htpasswd
Require valid-user
5 Likes