HTTP Authentication on OLS

Password-Protecting Pages with Basic Auth

HTTP Basic Authentication adds a username/password prompt before accessing specific pages or directories. This is useful for protecting staging sites, admin areas, or client preview sites.

Step 1: Create the Password File

Use the htpasswd utility (from Apache utils) to create an encrypted password file:

sudo apt-get install apache2-utils
sudo htpasswd -c /usr/local/lsws/conf/htpasswd YOUR_USERNAME

To add additional users (without the -c flag, which creates a new file):

sudo htpasswd /usr/local/lsws/conf/htpasswd ANOTHER_USER

Step 2: Configure OLS Realm

Edit the main OLS config to define a security realm:

# In httpd_config.conf
realm BasicAuth {
  userDB {
    location              /usr/local/lsws/conf/htpasswd
  }
}

Step 3: Apply to a Context

In your vhost config (vhconf.conf), add a context with the realm:

# Protect entire site (e.g., staging)
context / {
  location        /home/YOUR_DOMAIN/public_html/
  allowBrowse     1
  realm           BasicAuth
  authName        "Restricted Area"
  required        valid-user
}

# Protect only wp-admin
context /wp-admin {
  location        /home/YOUR_DOMAIN/public_html/wp-admin/
  allowBrowse     1
  realm           BasicAuth
  authName        "Admin Area"
  required        valid-user
}

Step 4: Restart OLS

sudo systemctl restart lsws

Alternative: .htaccess Method

If autoLoadHtaccess is enabled in your vhost, you can use an .htaccess file:

# /home/YOUR_DOMAIN/public_html/.htaccess
AuthType Basic
AuthName "Restricted"
AuthUserFile /usr/local/lsws/conf/htpasswd
Require valid-user

This method is simpler but slightly slower as OLS parses the file on each request.

Excluding wp-cron and AJAX

When protecting a whole site, ensure WordPress cron and AJAX still work:

# Allow wp-cron.php and admin-ajax.php without auth
<Files "wp-cron.php">
  Satisfy Any
  Allow from all
</Files>
<Files "admin-ajax.php">
  Satisfy Any
  Allow from all
</Files>

Security Notes

• Basic Auth sends credentials in base64 (not encrypted) — always use HTTPS
• The password file should not be in the web-accessible directory
• Use strong passwords — basic auth is susceptible to brute force without fail2ban