Learn how to set up a basic HTTP au­then­ti­ca­tion system. This will allow you to password protect par­tic­u­lar di­rec­to­ries on your website, so that they can only be accessed after logging in with a username and password.

This form of password pro­tec­tion is a fast and easy way to provide a basic level of security via access au­tho­riza­tion to a website.

Re­quire­ments

  • A server running Linux (Ubuntu 16.04 or CentOS 7)
  • NGINX installed and running.
Free Cloud Server Trial
En­ter­prise-grade virtual private servers
  • KVM based dev servers for de­vel­op­ers
  • Scalable to en­ter­prise cloud level
  • Pay-as-you-go, per-minute billing

Create the Password File with OpenSSH

Your server will most likely already have OpenSSH installed. If not, you can install it with the commands:

 CentOS 7:

sudo yum install openssh openssh-server openssh-clients openssl-libs

Ubuntu 16.04:

sudo apt-get install openssh-server

Use the following command to create a file named .htpasswd in the /etc/nginx directory:

sudo sh -c "echo -n '[username]:' >> /etc/nginx/.htpasswd"

For example, to add the user jdoe the command is:

sudo sh -c "echo -n 'jdoe:' >> /etc/nginx/.htpasswd"

Then add a password for this user with the command:

sudo sh -c "openssl passwd -apr1 >> /etc/nginx/.htpasswd"

You will be prompted to enter the password twice to confirm it.

Domain Transfer
Transfer your domain, hassle free
  • Zero downtime
  • Free SSL
  • $0 transfer fee, plus great offers

Set Up Password Au­then­ti­ca­tion in NGINX

The next step is to add the password au­then­ti­ca­tion di­rec­tives to the NGINX con­fig­u­ra­tion file for the domain on which you are in­stalling Joomla.

In most cases, the domain's con­fig­u­ra­tion file will be located in /etc/nginx/conf.d on CentoS 7, and /etc/nginx/sites-available on Ubuntu 16.04.

Edit this file:

CentOS 7:

sudo nano /etc/nginx/conf.d/example.com.conf

Ubuntu 16.04:

sudo nano /etc/nginx/sites-available/example.com.conf

You will add the following lines to this file:

auth_basic "Password Required";
    auth_basic_user_file /etc/nginx/.htpasswd;
Note

These two di­rec­tives will provide a basic password re­stric­tion to the specified directory. NGINX offers many ways you can set up password pro­tec­tion for various files and di­rec­to­ries, including the ability to filter by file type. If you want to set up a more com­pli­cat­ed system for password-pro­tec­tion, consult the official NGINX doc­u­men­ta­tion for more details.

To protect the entire site, put the di­rec­tives inside the existing location / command block. If no command block exists, add one:

location / {
    auth_basic "Password Required";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

If you wish to password-protect a sub-directory, specify that directory instead:

location /admin {
    auth_basic "Password Required";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

Be sure to add this location block inside the server block. For example, if your con­fig­u­ra­tion file looks like this:

server {
    listen       80;
    server_name  example.com;
    root /usr/share/nginx/example.com/html/;
    index index.php index.html index.htm;
}

After adding the new section, it will look like this:

server {
        listen             80;
        server_name    example.com;
        root /usr/share/nginx/example.com/html/;
        index index.php index.html index.htm;
location / {
        auth_basic "Password Required";
        auth_basic_user_file /etc/nginx/.htpasswd;
    }
}

Save and exit the file, then restart NGINX:

sudo nginx -s reload

To test the con­fig­u­ra­tion, visit the URL in a browser. If the con­fig­u­ra­tion is set up correctly, you will see a pop-up message asking you to enter the username and password.

Be secure. Buy an SSL cer­tifi­cate.
  • Secures data transfers
  • Avoids browser warnings
  • Improves your Google ranking
SSL Cer­tifi­cate Checker
Go to Main Menu