How secure is .htaccess?

Question

I've got a personal website I wish to lock down to everyone else except me. I've been using an .htaccess file for a bit and quite like it (they don't even see a webpage, just the login box), but will this protect me from everything? And can search engines still scan me?

I'm thinking of adding password lists here and I want them to be locked down.

Answer 1

In terms of blocking search engines via user-agent string, that is fairly trivial. In terms of blocking users by their user-agent string, forget about it, it's a waste of time.

If you are setting up a basic authentication login, be aware that these are susceptible to brute force attacks and passwords are sent in plain text. I would recommend using SSL if you are going to set this up for some added security. You may be interested in ModSecurity as well if you are concerned about brute forcing.

I would recommend posting your .htaccess file as well before putting it in place so it can be evaluated for any problems.

Answer 2

An .htaccess file is a set of instructions to your web server. If you tell it to require authentication before displaying pages, this will apply to everyone, search engines included (and only you have the password).

Make sure that your password file is not in a publicly-accessible directory. You can use this directive to completely block access to files starting with ".ht", although if your entire website is password-protected, this shouldn't be an issue.

<FilesMatch "^\.ht(.*)$">
  Deny from all
</FilesMatch>

Note that if your connection is not SSL-encrypted, this setup will not be entirely secure. Anyone between you and the web server can intercept your connection and sniff your password - for example, if you are using public wi-fi at a coffee shop. However, consider how much security you need, because SSL can be complicated and expensive to set up. For practical purposes, an .htaccess file should be sufficient to keep unwanted visitors away from your website.

P.S. Use HTTP Digest authentication instead of Basic - it's a little more secure.