How to protect admin login with htaccess password in magento?
Can I add htaccess password restriction for the admin login only?
Magento Stack Exchange is a question and answer site for users of the Magento e-Commerce platform. It only takes a minute to sign up.
Sign up to join this communityHow to protect admin login with htaccess password in magento?
Can I add htaccess password restriction for the admin login only?
As far as I know, htpasswd
(password prompt by using .htaccess
file) requires an actual directory and the .htaccess
file to be placed there. Since there's no directory for your admin URL, I don't think you can do this with htpasswd
.
Add below code to your root htaccess file and don't forget to change your admin url, .htpasswd
file page.
<Files "admin">
AuthName "Cron auth"
AuthUserFile E:\wamp\www\magento\.htpasswd
AuthType basic
Require valid-user
</Files>
Create .htpasswd file in your root folder and add below username and password (set default username:admin and password: admin123)
admin:$apr1$8.nTvE4f$UirPOK.PQqqfghwANLY47.
Please let me know if you still facing any issue.
I would take a good read of the following result I just found by Googling your query, specifically 4. Use a custom admin path and 10. Restrict admin access to only approved IP addresses: http://addoa.com/blog/ten-tips-keeping-your-magento-store-secure
So if you are doing this for "security" reasons I would suggest that secure passwords and possibly changing the admin url would be enough.
To change the admin url simply update app/etc/local.xml
and change the following section.
<admin>
<routers>
<adminhtml>
<args>
<frontName><![CDATA[admin]]></frontName>
</args>
</adminhtml>
</routers>
</admin>
I just had to do this and I used the Location tag in apache:
<Location /admin>
Options FollowSymLinks Indexes SymLinksIfOwnerMatch
AuthType Basic
AuthName "Restricted Files"
# (Following line optional)
AuthBasicProvider file
AuthUserFile /home/public_html/.htauth
Require user admin
</Location>
use the command:
htpasswd -c /home/public_html/.htauth admin
to create the htauth.
All worked as expected.