Sometimes you need to add an extra layer of security to your WordPress site beyond the standard login system. Maybe you want to protect your admin area from brute force attacks, or you have sensitive files that need additional security.
Using .htaccess files for password protection works at the server level, which means it kicks in before WordPress even loads. This makes it a powerful way to protect directories, specific files, or even your entire site. Here’s how to set up .htaccess password protection for your WordPress site.
What is the .htaccess file?
The .htaccess file is a configuration file that Apache web servers read to determine how to handle requests for your website. It sits in your website’s directory and can control things like redirects, caching, security settings, and URL rewrites.
You’ll find the .htaccess file in your WordPress root directory (the same folder that contains wp-config.php). Sometimes this file is hidden by default, so you might need to enable “Show hidden files” in your file manager or FTP client to see it.
WordPress uses .htaccess for things like pretty permalinks, but you can also use it to add your own server-level security rules.
Basic directory password protection
To password protect a directory, you need two files: .htaccess and .htpasswd. The .htaccess file contains the protection rules, while .htpasswd stores the actual usernames and passwords.
Step 1: Create the .htaccess file
Create a new .htaccess file in the directory you want to protect and add this code:
AuthType Basic
AuthName "Protected Area"
AuthUserFile /full/path/to/.htpasswd
Require valid-user
You’ll need to replace /full/path/to/.htpasswd with the actual server path to your .htpasswd file. This is usually something like /home/yourusername/public_html/protected/.htpasswd.
Step 2: Create the .htpasswd file
Create a file called .htpasswd and add your login credentials in this format:
username:encryptedpassword
Don’t use a plain text password here. Instead, use an online .htpasswd generator to create encrypted passwords. These tools let you enter a username and password, then give you the properly formatted line to add to your file.
For multiple users, put each username and password combination on a separate line:
user1:$2y$10$abc123encryptedpassword
user2:$2y$10$def456encryptedpassword
user3:$2y$10$ghi789encryptedpassword
Step 3: Upload both files
Upload both the .htaccess and .htpasswd files to the directory you want to protect. The .htaccess file goes in the protected directory, while .htpasswd can go anywhere on your server (just make sure the path in .htaccess matches).
IP-based access control
Sometimes you want to allow certain IP addresses to bypass password protection entirely. This is useful if you want your team to access a staging site without entering passwords, or if you’re limiting access to specific locations.
Allow specific IPs without passwords
This code allows certain IP addresses to access your protected directory without entering a password, while everyone else still needs to log in:
<IfModule mod_authz_core.c>
AuthName "Username and password required"
AuthUserFile /home/path/.htpasswd
AuthType Basic
<RequireAny>
Require valid-user
Require ip 111.222.333.444
</RequireAny>
</IfModule>>
Replace 111.222.333.444 with the actual IP address you want to whitelist. To allow multiple IP addresses, add additional Require from lines:
Require from 111.222.333.444
Require from aaa.bbb.ccc.ddd
Require from localhost
Block specific IP addresses
If you want to block certain IP addresses from accessing your protected directory (even with the correct password), use this approach:
<IfModule mod_auth_basic.c>
AuthName "Username and password required"
AuthUserFile /home/path/.htpasswd
AuthType Basic
<RequireAll>
Require valid-user
Require not ip 111.222.333.444
Require not ip aaa.bbb.ccc.ddd
</RequireAll>
</IfModule>
You can also block entire IP ranges by using partial addresses. For example, Require from 111.222 would block all IP addresses that start with 111.222.
Protecting individual files
Instead of protecting entire directories, you can password protect specific files.
Single file protection
To protect one file, add this to your .htaccess:
<IfModule mod_auth_basic.c>
<Files "protected.html">
AuthName "Username and password required"
AuthUserFile /home/path/.htpasswd
Require valid-user
AuthType Basic
</Files>
</IfModule>
Replace “protected.html” with your actual filename.
Multiple file protection
To protect several specific files at once:
<IfModule mod_auth_basic.c>
<FilesMatch "(protected\.html)|(passwords\.txt)">
AuthName "Username and password required"
AuthUserFile /home/path/.htpasswd
Require valid-user
AuthType Basic
</FilesMatch>
</IfModule>
Protect by file type
You can also protect all files of certain types:
<IfModule mod_auth_basic.c>
<FilesMatch "\.(inc|txt|log|dat|zip|rar)$">
AuthName "Username and password required"
AuthUserFile /home/path/.htpasswd
Require valid-user
AuthType Basic
</FilesMatch>
</IfModule>
This example protects all .inc, .txt, .log, .dat, .zip, and .rar files in the directory.
Plugin alternatives
If .htaccess protection seems too complex, or you want more user-friendly password forms, plugins like Password Protect WordPress (PPWP) can provide similar functionality with a better interface.
Plugins offer advantages like better password management, multiple passwords per page, and more attractive login forms. However, they work at the WordPress level rather than the server level, so they’re not quite as secure as .htaccess protection.
The truth is that .htaccess protection is one of the most secure ways to password protect content because it happens before WordPress even loads. This makes it nearly impossible for attackers to bypass, unlike plugin-based protection that could potentially be circumvented if WordPress itself is compromised.
For most situations, .htaccess protection provides robust security with relatively simple setup. Just remember to keep your .htpasswd file outside your web root directory, or at least make sure it can’t be accessed directly through a web browser.
