How to protect admin login with htaccess password in magento?
Can I add htaccess password restriction for the admin login only?
asked Nov 5 '14 at 12:20
-
1Why would you do this? – Fabian Blechschmidt Dec 14 '14 at 16:48
As far as I know, htpasswd (password prompt by using .htaccess file) requires an actual directory and the .htaccess file to be placed there. Since there's no directory for your admin URL, I don't think you can do this with htpasswd.
answered Mar 20 '15 at 21:47
-
This is wrong in every way. Firstly htpasswd based authentication (i.e. "basic" Authentication) can be defined outside of .htaccess in config files and secondly it can be defined using Location or LocationMatch directives, it is not restricted only to Directory directives. – BlueC Oct 5 '17 at 13:05
Add below code to your root htaccess file and don't forget to change your admin url, .htpasswd file page.
<Files "admin">
AuthName "Cron auth"
AuthUserFile E:\wamp\www\magento\.htpasswd
AuthType basic
Require valid-user
</Files>
Create .htpasswd file in your root folder and add below username and password (set default username:admin and password: admin123)
admin:$apr1$8.nTvE4f$UirPOK.PQqqfghwANLY47.
Please let me know if you still facing any issue.
I would take a good read of the following result I just found by Googling your query, specifically 4. Use a custom admin path and 10. Restrict admin access to only approved IP addresses: http://addoa.com/blog/ten-tips-keeping-your-magento-store-secure
So if you are doing this for "security" reasons I would suggest that secure passwords and possibly changing the admin url would be enough.
To change the admin url simply update app/etc/local.xml and change the following section.
<admin>
<routers>
<adminhtml>
<args>
<frontName><![CDATA[admin]]></frontName>
</args>
</adminhtml>
</routers>
</admin>
answered Mar 20 '15 at 15:56
I just had to do this and I used the Location tag in apache:
<Location /admin>
Options FollowSymLinks Indexes SymLinksIfOwnerMatch
AuthType Basic
AuthName "Restricted Files"
# (Following line optional)
AuthBasicProvider file
AuthUserFile /home/public_html/.htauth
Require user admin
</Location>
use the command:
htpasswd -c /home/public_html/.htauth admin
to create the htauth.
All worked as expected.
