Viewing Thread:
"VIP Directory Protection"

Hi,

I am very confused with your implementation of 'VIP .htaccess' via the control panel.

I have protected a directory tree, but I see that in that tree is the .htpasswd file where the .htaccess file should be, and there is no corresponding .htaccess file.

I am wondering if it is throwing a part of my site backend admin out.

Neil

P.S. You may prefer to email me directly if the info is sensitive.

Ah - I was always given to understand that htpasswd was placed above visible webspace and htaccess was placed in the applicable directory.

N.

No, .ht....whatever files should be in the directory they apply to. They will then apply to any sub-directories also. The server won't serve out .(dot) files so security shouldn't be effected.

...but isn't having the .htpasswd file in the actual directory a security risk, as it should be above visible webspace?

I tried putting the contents of it in an existing one at my space root and the directory was no longer protected (so I put it back).

N.

Neilj99 wrote:
> If thats the case, why does a .htpasswd file appear in the
> directory in question after protection is enabled via the control
> panel?
>
> *Confused*
>
> N.

The .htpasswd file is used to store your username and password for that directory. The vhosts conf file is used to state what directories need to read their .htpasswd files.

If thats the case, why does a .htpasswd file appear in the directory in question after protection is enabled via the control panel?

*Confused*

N.

Yep that's correct. Directory protection is controlled by the vhost config file for your account. There are other setting that work the same way, such as the rewrite rules, but you can also put these in a .htaccess file.

Although .htaccess files can be used to implement directory protection using .htpasswd files, they are not necessarily needed if the directory protection is turned on at a lower level on the server say in the httpd.conf file. I presume our servers operate at this lower level to keep excess files out of your hosting folders and also for performance reasons.

I have had a look at your password protected folders and it looks like the protection is working fine, I hope you are not having any issues with directory protection?

Hi,

I am very confused with your implementation of 'VIP .htaccess' via the control panel.

I have protected a directory tree, but I see that in that tree is the .htpasswd file where the .htaccess file should be, and there is no corresponding .htaccess file.

I am wondering if it is throwing a part of my site backend admin out.

Neil

P.S. You may prefer to email me directly if the info is sensitive.