I would like to set a .htpasswd on a folder within my templates directory. Here is what I did:

..create the .htpasswd file and place in directory above my public folder ..create a .htaccess file that points to the .htpassword file, and place it in the folder I want to protect, which is in my templates directory.

When I enter a url to access the page, it displays the page fine, but does not trigger the .htpasswd. If I move the folder to my root directory, everything works fine.

Why does this not work as a Craft template?

  • 2
    Gonna ask a couple stupid questions, because I might have an answer, but I'm clear what you're trying to accomplish - Why are you password protecting your templates directory? No browser can get to your config or templates, it can only get into your webroot. Are you just trying to password your site? Or protect certain pages?
    – SamC
    Commented Jan 25, 2020 at 23:31
  • Sorry, should have provided a bit more detail. The client is a start-up non-profit who does not want to spring for a Craft Pro license at this point. One of the site features is a photo gallery, and they would like to upload images. That requires using Twig, which means using a template. Need to password protect the "upload image" page for obvious reasons (not the entire template directory).
    – Roi Agneta
    Commented Jan 27, 2020 at 16:21
  • Hm. Do the images auto-load into the slideshow? To be honest, if it were my site, I'd make people send images in via something like wetransfer or dropbox (with lots of storage), and then have admin load them to the site - that way they can approve or reject images for a variety of reasons.
    – SamC
    Commented Jan 28, 2020 at 17:35
  • Saw this new plugin in the store today - might be a simpler solution - plugins.craftcms.com/basicauth
    – SamC
    Commented Feb 13, 2020 at 16:58

1 Answer 1


It's not doing it due to order of operations. Your browser hits the site, checks htaccess (in the webroot /html/), and then asks craft for whatever page. Craft goes hunting around, and returns your page from templates. And it's Craft (not you the user) accessing the templates, so it's always 'approved.'

Here's a potential solution. Take a look at this page - https://noahread.net/blog/create-password-protected-pages-in-craft

It's how to create a single password-protected page. Uses a for a password. And that password is hidden in a craft variable, so no one can see it. If it returns successfully, you get content.

All that said, craft pro might be cheaper than the time spent building said form.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.