Authentication & Access Control in Apache

From the Apache cheat sheet · Security & Access Control · verified Jul 2026

Authentication & Access Control

Password-protect directories and restrict access by IP

apacheconf

# Password-protect a directory
<Directory /var/www/admin>
    AuthType Basic
    AuthName "Admin Area"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Directory>

# Create password file
# htpasswd -c /etc/apache2/.htpasswd admin

💡 htpasswd -c creates the file — omit -c when adding users to an existing file or it overwrites

⚡ Options -Indexes prevents directory listing — always disable this in production

📌 Block .env, .git, and backup files with FilesMatch — they should never be web-accessible

🟢 Combine Require valid-user + Require ip inside <RequireAll> for defense in depth

authhtpasswdaccess-control

More Apache tasks

Security Best Practices
Headers & CORS

Back to the full Apache cheat sheet