htaccess protected folder

[floko]

Hi everyone,
I just set up a very simple htaccess password protection for a folder on our website (which is run by PW of course). To be specific, I placed a .htaccess file within that folder, referencing a .htpasswd file in the same folder. 
However, somehow the PW mechanics redirect to the standard PW 404 page of our website whenever I try to open any file within that folder (instead of prompting the htaccess login and password fields). 

Thanks in advance for any hints!
 

[BrendonKoz]

Are you hosting the htpasswd protected folder within the site/ folder, or beside it? 

PWSITE:

• - /site/
• - /wire/
• - /index.php
• - /.htaccess (PW root htaccess)

I have placed folders at root (the same level as site and wire), and haven't had any issues with similar situations, so long as the file name(s) are correctly typed and matching the case sensitivity. Any PW-specific subfolders would also be subject to whatever htaccess rules those subfolders possess, so it's easier to just have separate-need folders at root level.

[floko]

Thanks for your help!
The protected folder and the htaccess file are beside the "site" folder.

PWSITE:

• - /site/
• - /wire/
• - /index.php
• - /.htaccess (of PW installation)
• - /protected-subfolder/
• - /protected-subfolder/.htaccess
• - /protected-subfolder/.htpasswd

[BrendonKoz]

I just gave things a shot on my end with a similar structure, on my DDEV development machine, and was able to (eventually) successfully access the contents of the folder once I got past the htpasswd basic authentication.

The error I experienced was that I was receiving a 500 server error, in this folder, at first. Since I knew things were working before implementing the htpasswd/htaccess combination in this particular folder, I checked the logs. DDEV is not clear on which server the logs are from, but I believe in this case it was Apache (I am not using NGINX). The error message was:

Quote

[Thu Jun 18 17:01:10.328232 2026] [authn_file:error] [pid 1627:tid 1662] (2)No such file or directory: [client 172.18.0.5:44474] AH01620: Could not open password file: /.htpasswd

My htaccess AuthUserFile directive used a relative path; it seems this particular instance of Apache didn't like that, so I opted for a full path. That worked, and I was once again able to access the content of that folder (after getting beyond the basic auth).

Now, all that being said, you say you're getting the ProcessWire-generated 404 page. Thankfully, the 404 page is itself an error document, so there should be some sort of logs, somewhere, that would report why you're getting that output. Have you checked any of the logs to see, by chance? Have you tried creating another directory (temporarily) with a test file in it just to see if you can get that to load - one that is not protected by a basic password?

Have you edited, and/or reviewed, the default ProcessWire installation's .htaccess file to see if there might be a conflict - possibly due to file extension?

[floko]

Thanks a lot for your help, very much appreciated!

As you suggested, I created another blank folder  "htaccesstest" and uploaded a blank index.html into that folder. Called that folder via URL in a browser and received a blank page, as expected. As soon as I set up a .htaccess and a .htpasswd file, I was again redirected to Process Wire's 404 page.
However, no corresponding line was added to errors.txt or exceptions.txt in site/assets/logs/

To see what happens and maybe provoke an error notification, I removed the .htpasswd file, while the .htaccess was still referencing it.
(I am using only absolute paths.)
Again, a 404 has been shown, without additional error messages in any log file.

Regarding the ProcessWire installation's .htaccess file: Since I tested both with standard index.php and index.html files, I don't believe file extensions could cause this issue.

Maybe I will have to look for an alternative approach...
Thanks again!

 

 

 

[virtualgadjo]

hi,

have you tried the simple
RewriteRule ^(yourdirectory)/.*$ - [L]
in pw htaccess ? it may be a simple and easy solution not to have to go and implement a more complex workaround

have a nice day
 

[floko]

Hi,

Thanks a lot, I will definitely try!

(I have no access to my computer for the next 14 days)

Thanks again!

[virtualgadjo]

@floko my pleasure, il's usually a very easy way to exclude a directory from the rules of an htaccess that is at the root level and, of course, allows to submit this directory to its own htaccess rules

have a nice day and nice 14 days away from your computer 🙂

[BrendonKoz]

Good suggestion, @virtualgadjo! I'm still confused at why floko's attempt, as described, did what it did. Maybe I'm just too focused on the problem as opposed to the solution! 😅 Still, a 404 error should provide an error log somewhere, but if it's an Apache-level error, ProcessWire wouldn't handle it. PW would display its 404 because it's been configured to do so whenever a 404 error was created by the Apache webserver. Apache logs don't show up in ProcessWire, they'd be at the host (account) level.

Unless there's proof otherwise, it may even be possible that the host doesn't allow basic auth using htaccess and htpasswd files...?

[virtualgadjo]

hi @BrendonKoz exaclty like you said in your answers, the first thing i thought about was all those directories i use outside pw /site one for special cron jobs (not lazy ones :)) downloadable files and so on without any problem... but you're right, first thing to check is if the host allows htacces protection (if not, time to change because it would sound a bit prehistoric 😄 )
afterwards, maybe the url he gives as pw htaccess prevents direct access to php files for exemple
that why my second thought was to exclude the directory from pw htaccess rules and then put his own ones in the directory htaccess and see what happens, it's a bit harsh but also a simple debug attempt 🙂

have a nice day

[BrendonKoz]

Oops! I should have created a new paragraph after mentioning you, virtualgadjo. The continuation of my message was actually intended for floko, but appreciate the additional thoughts in your response! 😅 It was nice reading how your thoughts progressed through the problem.

[floko]

Thanks again for all your valuable input!

@virtualgadjo
Your elegant workaround didn't work for me - although I might have inserted the suggested line at a wrong position, right before 19. ("pass control to processwire if all the above directives allow us to this point").

However, I just made a test by changing the htaccess content to a simple redirect, which worked fine. So it seems to me that the path to .htpasswd file could be the problem.
But I doubled checked via php output:
echo dirname(__FILE__) . '/.htpasswd';
and the path is identical. So I still have no idea what might be the underlying problem...

[virtualgadjo]

hi @floko
hard to answer for sure but i would use the line inside the 20 or 19 section after the existing line

but you must be right, no reason not to work for the protection rules, if i want to know the exact path to the htpasswd file, the simplest way is to put a php file in the folder where your htpasswd is with just a phpinfo() in it
call the file in your browser and look for $_SERVER['SCRIPT_FILENAME'] in the php variableq, then replace the file name by your .htpasswd name as the last part of the var, you'll get the correct file path to use in your .htaccess
something important, don't forget to delete the phpinfo file once you're done, never a good idea to offer that kind of info to people with not that good intentions 😄

have a nice day

[floko]

The path shown via phpinfo() is still identical with the one via dirname(__FILE__). So it seems correct. 

Thanks anyway for all your ideas, have a nice day as well!

[virtualgadjo]

hi,

that's funny do you want me to put a working example with this simple example
--- htaccess
AuthName "please say who you are"
AuthType Basic
AuthUserFile "/path/to/your/.htpasswd"
Require valid-user
--- htpasswd
toto:$2y$10$pSGwtO1cWrh/E51gd2vIWOdupO0g1QEaMgfsrjV6dICfrBsLURn/e

it works like a charm in a folder besides site and wire exactly like in your example without changing anything in my pw htaccess
- password is toto encrypted with password_hash('toto', PASSWORD_BCRYPT);

have a nice day

[virtualgadjo]

hi again 🙂

being very surprised i couldn't search a little about this problem and found something that can explain it
in fact if your website is not running on a genuine apache online but a LiteSpeed with cpanel it seems to be a wellknown issue a simple solution (i've dug into far less simple ones...) would be to create a subdomain for the target folder, sorry to be back with such bad news...

have a nice day anyway

[floko]

That might indeed be the cause - our webserver is managed via cpanel (although I don't know, if in combination with LiteSpeed). In any case, this hint does help a lot!
I will check if setting up a subdomain is possible and if this could be a solution to our problem.

Thank you very much!

[virtualgadjo]

hi,

If you want to find out which server is being used, open the console (F12), go to the “Network” tab, and refresh the page. Once the page has reloaded, look for “server” among the displayed variables. If it's not Apache or Nginx, there's a good chance it's LiteSpeed, even if it has a custom name specific to your hosting provider.

in case it helps

have a nice day