Previously using Magento 1 I have been able to secure dev sites easily using a .htaccess / .htpasswd setup. It's just to keep the site from being viewed before it's ready. However the same setup in Magento 2 seems to have problems.

After entering the password prompt triggered by the .htaccess I can login to the Magento 2 admin but it then shows an error 'Something went wrong' and nothing will work after that. Everything works fine without the .htaccess code in place.

Any suggestions how to avoid this error using .htaccess. I only need to use it to password protect the front end so even a solution to exclude the admin url would work.

This is the code I'm using in the .htaccess file, put right at the end of the file.

AuthUserFile /home/site/public_html/.htpasswd
AuthName "Username and password required"
AuthType Basic
Require valid-user
<Limit GET POST>
  Require valid-user
  • It looks like the error is related to the session key. The browser console shows an error relating to loading: admin/noroute/index/key/42c798fa90676c74921a9020aa876ff737412784c3ed9a4576cf13651b6a7e35/ load resource: the server responded with a status of 404 (Not Found) This only happens with the .htaccess / .htasswd enabled. – TimDavies May 18 '18 at 13:33

I didn't understand your question completely, But you can enable .htaccess password-protection using below way.


AuthType Basic
AuthName "My Protected Area"
AuthUserFile /path/to/magento/.htpasswd
Require valid-user



Above is worked for me.

  • This is exactly what I have and it does work for me most of the time but it seems that for new users they can login to Magento but then it pops up with an error saying 'something went wrong' and they are unable to do anything in the admin. – TimDavies May 9 '18 at 6:34
  • I think Something went wrong, Its error from Magento side, There's nothing related to .htaccess. – user67337 May 9 '18 at 6:38
  • Yes, it's a Magento error but it only shows when the AuthType code is added to the .htaccess file. As soon as I remove the code it works as normal. Can there be a way so that the .htaccess only protects the frontend and not the Magento admin? – TimDavies May 9 '18 at 6:43
  • You can try to give authentication from server side as well. – Hitesh Agrawal Feb 26 '20 at 7:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.