Forbidding access:

Setting a password:


Frequent errors:

Programs list for managing of the Apache servers


What is .htaccess for?

When you type an address in the address bar of your browser, your computer receives files that your browser displays. The web server controls which files and how should be displayed (sent) to you. The two most popular servers are IIS and Apache.

Like any other software, a web server has certain settings. However, as an Apache user, you may have no (and if we talk about virtual hosting, most probably you will have no) rights to change the Apache configuration using its main configuration files that affect all server users. But you can modify some configuration files that affect only your website. One of such files is .htaccess.

It is a flexible Apache web server configuration file. “Flexible” means that as soon as you modify anything in this file, the changes are applied immediately. You can use it to redefine a lot of directives from the file httpd.conf (this file is the main configuration file in Apache and it affects absolutely all users of this Apache copy). In those cases when you have no access to the Apache configuration file (exactly in case of virtual hosting), it is this file that will help you.

A web user cannot access this file using the browser. If the .htaccess file is located in the root directory of the server, it affects the entire server except those directories where other .htaccess files are stored (and except all their subdirectories).


Your directories have the following structure on the server:

The directories ‘user1’ and ‘user2’ will be subdirectories for the user directory. If we put the .htaccess file in the ‘user’ directory, it will automatically affect directories ‘user1’ and ‘user2’.

We save another .htaccess file to the ‘data’ directory, this file is different from the one stored in the ‘user’ directory. The .htaccess file located in ‘data’ will affect the directories ‘data1’ and ‘data2’.

Now we save another .htaccess file that is different from the one stored in the directory 2 levels higher (the ‘user’ directory) to the ‘user2’ directory. As a result, the settings of the ‘user2’ directory will be defined only by the .htaccess file located in this directory.

Since most often Apache is configured in such a way that it always searches each directory for this file, .htaccess will help you quickly reconfigure the server without stopping it.

.htaccess syntax

Here is the required syntax. If you do not observe it, it will result in server errors.

—  paths to files (directories) are specified from the server root. Example: /opt/home/
—  domains with protocols specified. Example: Redirect /

The file name is exactly “dot” htaccess. It must be in the UNIX format (ASCII mode).

How to forbid visitors to read files from a directory?

Forbidding all files:

deny from all

Allow access from a certain IP address:

order allow deny
deny from all
allow from <your_IP>

In this case, <your_IP> stands for a specific address. For example:

order allow deny
deny from all
allow from

Forbid access from a certain IP address:

order allow deny
deny from all
deny from <your_IP>

Using <your_IP> is similar to the example above.

Forbidding a group of files by mask:

<Files ~ "\.(inc|sql|...other_extensions...)$">
  order allow,deny
  deny from all

Defines access to a file by its extension. For example, forbidding web visitors to access files with the “inc” extension:

<Files ~ "\.(inc)$">
  order allow,deny
  deny from all

In this example the Apache server can access files with this extension.

Forbidding a particular file:

You can forbid a particular file using its name and extension.

  order allow,deny
  deny from all

This example forbids the file to be accessed.

Setting a password

Password for a directory:

AuthName "Private zone"
AuthType Basic
AuthUserFile /pub/home/your_login/.htpasswd
require valid-user

AuthName will be displayed for the user and can be used to explain authentication request. The value of AuthUserFile defines the location where the file with passwords for accessing this directory is stored. This file is created by a special tool named htpasswd.exe or more convenient and flexible program Htpasswd Generator.

For example, we create the following .htaccess file in the protected directory:

AuthName "For Registered Users Only"
AuthType Basic
AuthUserFile /pub/
require valid-user

In this example, the user requesting this directory will read the message “For Registered Users Only”, the file with passwords for access must be stored in the directory /pub/ and it must be named .htpasswd . The directory is specified from the server root. If you specify the directory incorrectly, Apache will not be able to read the .htpasswd file and nobody will get access to this directory.

Password for one file only:

Similar to protecting a whole directory with a password, you can set a password for one file only. An example of setting a password to the file

  AuthName "Users zone"
  AuthType Basic
  AuthUserFile /pub/home/your_login/.htpasswd

Password for a group of files:

Similarly, you can use <Files ~ "\.(inc|sql|...other_extensions...)$"> to set password for files by mask. An example of setting a password for accessing all files with the “sql” extension:

<Files ~ "\.(sql)$">
  AuthName "Users zone"
  AuthType Basic
  AuthUserFile /pub/home/your_login/.htpasswd

Checking access rights

Task: there is a directory named a1 containing two subdirectories (a2, a3), there are two access levels for users. The first group can access only a1 and a2, the second group can access all three directories. You should perform authentication only once – when accessing a1, but observe access rights for ?2 and ?3.
The username and password are requested only once while accessing ?1 – if the user has access to ?2, the password it not requested again. If the user has no access to ?3, he will see the message “Enter the password”.

a1 – common and protected at the same time
?2 and ?3 only for certain users.

The .htaccess file for the directory ?1:

AuthName "Input password"
AuthType Basic
AuthUserFile "/pub/home/your_login/htdocs/closearea/.htpasswd"
<Files *.*>
  require valid-user

The .htaccess file for the directory ?2:

AuthName "Input password"
AuthType Basic
AuthUserFile "/pub/home/your_login/htdocs/closearea/.htpasswd"
<Files *.*>
  require user user1 user2 user3
</Files *.*>

The .htaccess file for the directory ?3:

AuthName "Input password"
AuthType Basic
AuthUserFile "/pub/home/your_login/htdocs/closearea/.htpasswd"
<Files *.*>
  require user user1 user4 user5
</Files *.*>

How to redirect a visitor?

Redirecting to another URL:

To redirect a visitor to, add the following to .htaccess

Redirect /

Displaying different pages depending on the visitor’s IP address:

SetEnvIf REMOTE_ADDR <required_IP> REDIR="redir"
RewriteCond %{REDIR} redir
RewriteRule ^/$ /another_page.html

For example, redirecting visitors with IP to the page about_my_site.html:

RewriteCond %{REDIR} redir
RewriteRule ^/$ /about_my_site.html

Redirecting a visitor when he request certain pages:

It is already for all network viruses and scanners. Now any request with the address /_vti_bin will be automatically redirected to Microsoft:

redirect /_vti_bin
redirect /scripts
redirect /MSADC
redirect /c
redirect /d
redirect /_mem_bin
redirect /msadc
RedirectMatch (.*)\cmd.exe$$1

How to change the default page?

To change the page that will be displayed when a visitor access a directory, write:

DirectoryIndex <necessary page>

It is possible to specify several pages:

DirectoryIndex index.shtml index.php index.php3 index.html index.htm

How to make Apache process SSI directives?

SSI allows you to “assemble” a page using its parts. You have the code of the menu in one part, the code of the header in another part and the footer in a third part. And the visitor sees a usual page consisting of the code stored in your parts.

Some settings in httpd.conf are required.

Add Includes to the Options directive in the block starting with <Directory/> and ending with </Directory>.

After that add the following to the .htaccess file:

AddHandler server-parsed .shtml .shtm .html .htm

If you want to use some kind of GUI for managing Apache server and do all these manipulations easily (using the special wizards and managers) then we advise you to use the program ApacheConf

How to process Apache errors yourself?

The most interesting and useful Apache errors are 403-404, 500.

403 – the user has not been authenticated, access denied (Forbidden).
404 – the requested document (file, directory) is not found.
500 – internal server error (for example, an error in the syntax of the .htaccess file).

For the user to see your own error messages for these error, add the following to .htaccess:

ErrorDocument 403 /errors/403.html
ErrorDocument 404 /errors/404.html
ErrorDocument 500 /errors/500.html

If error 404 occurs, the user receives the file errors/403.html.

It is convenient to create your own handler for some errors. Add the following to .htaccess:

ErrorDocument 403 /errors/error.php?403
ErrorDocument 404 /errors/error.php?404
ErrorDocument 500 /errors/error.php?500

Determine the document that caused error in error.php using $HTTP_SERVER_VARS[‘REQUEST_URI’] and process it then. If .htaccess contains the file with the full path for ErrorDocument (, $HTTP_SERVER_VARS[‘REQUEST_URI’] will contain this file instead of the one that caused the error.

Internet Explorer 5.0 incorrectly processes the error file if it is smaller than 1 kilobyte. It opens the standard IE 404 page.

How to forbid the contents of a directory to be displayed if it has no index file?

Suppose all graphics used on your site is stored in the ‘img’ directory. A visitor can type the address of this directory in his browser and see the list of all your image files. Of course, it will not cause any damage, but you might forbid the visitor to view this directory as well. Add the following to .htaccess:

Options -Indexes

Is it possible to specify the encoding of all file the browser receives documents in by default?

When the Internet only came to existence and first browsers appeared, it often happened that the browser could not automatically determine which of the Russian encodings a document was written in and the browser displayed a complete mess. To avoid it, specify that all pages will be encoded in Windows-1251:

AddDefaultCharset windows-1251

Is it possible to specify the encoding of uploaded files?

When a visitor uploads a file to the server, it is possible to recode it. To do it, specify that all uploaded files will be encoded in Windows-1251:

CharsetSourceEnc windows-1251

Frequent errors

I created the .htaccess file, but the server returns 500 – Internal Error

There is an error in its syntax or the file is saved in the wrong format. See this question.

What programs do exist for managing of the Apache server

There are several programs for tuning and controlling the Apache servers.

The most powerful Graphical User Interface (GUI) for Apache server tuning has ApacheConf. ApacheConf is a shell (GUI) for configuring Apache web servers that will help you to tune the main configuration httpd.conf file. ApacheConf presents all the information in the httpd.conf file in a structured view. All of the server’s directives are grouped by category (Global directives, Directories, Virtual hosts, etc) and all these groups are represented as a tree. In this way,you can see the entire structure of the server at a glance and you can easily manage all of the server’s directives, as well as the directories and virtual hosts.

Also we advise you to to use Apache Commander.

And of course Htpasswd Generator for managing your users, user groups and their passwords

Leave a comment

Your email address will not be published. Required fields are marked *

Blue Captcha Image


Protected by WP Anti Spam

Hit Counter provided by dental implants orange county