Some parts of your site are often sensitive, such as the admin section. To enforce stricter access on the files in those directories, it can be wise to add another layer of protection. The .htaccess file lets you set access ACLs on a directory or a file.
You need the Apache2 service installed.
.htaccess files are extremely effective at restricting access to a directory.
Before starting, make sure the following lines in /etc/apache2/apache2.conf are uncommented; create them if they aren’t:
<Files ~ "^.ht">
Order allow,deny
Deny from all
Satisfy all
</Files>
These lines make .htaccess files invisible to everyone.
For reference, you can avoid creating .htaccess files by using the directives of your VirtualHosts with the same settings.
Add the following lines to make the .htaccess functionality work:
AuthName "Accès Interdit"
AuthType Basic
AuthUserFile "/var/www/prive/.htpasswd"
Require valid-user
Then you need to create the password file. In recent versions of Apache this text file stores hashed passwords.
To create the .htpasswd file:
.htpasswd -c .htpasswd toto
password: ****
repeat password: ****
Drop the -c option once the file exists in order to add users.
Your directory is now protected.
WARNING: even though the passwords are hashed on the server, they transit in clear text over the network unless you use SSL.