How to Set Up Nginx Basic Authentication in Ubuntu 24.04

What is Nginx Basic Authentication?

Nginx Basic Authentication is a simple access control mechanism that prompts users for a username and password before allowing access to specific web content. It uses the standard HTTP Authorization header and works with virtually all modern web browsers and HTTP clients.

When Basic Authentication is configured, users attempting to visit a protected area of your website will be required to log in using credentials stored in a secure file on the server.

Purpose and Use Cases

Basic Authentication is ideal for:

Protecting admin areas or staging sites from unauthorized users
Restricting access to internal dashboards, APIs, or static content
Providing temporary access control during development or deployment
Creating a lightweight login layer without implementing full authentication systems

How It Works

A username and an encrypted password are stored in a file (commonly known as .htpasswd).
Nginx references this file to verify credentials.
If a user attempts to access a protected path, they will receive a login prompt.
If valid credentials are entered, access is granted; otherwise, the user sees a “401 Unauthorized” error.

Benefits

Simplicity: Easy to set up with minimal configuration
Compatibility: Works with most HTTP clients and browsers
No code changes required: Managed entirely at the web server level
Effective for small-scale access control

Security Considerations

HTTPS is essential: Basic Authentication transmits credentials in base64-encoded format, not encrypted. TLS/SSL ensures credentials aren’t exposed in transit.
Password management: Use strong, unique passwords and consider rotating them periodically.
Restricted access: The password file should be kept outside of publicly accessible directories.
IP filtering: For additional security, you can combine Basic Auth with IP whitelisting.
Brute-force protection: Use tools like Fail2Ban or rate limiting features to prevent repeated login attempts.

Limitations

No session handling: Once the browser sends credentials, it will continue to do so until it’s closed or cleared.
No password recovery: There is no built-in system to reset or recover passwords.
Not ideal for public or high-security applications: Best used for internal or low-risk areas.
User experience: The login prompt is browser-based and not customizable.

Nginx Basic Authentication on Ubuntu 24.04 is a simple and effective solution for securing access to certain parts of your website or server. While it lacks advanced features like session tracking or user management, it’s perfect for quick protection of sensitive areas such as admin panels, development sites, or private dashboards.

For maximum security, it should always be used in conjunction with HTTPS and other hardening techniques, especially in production environments.

Step 1: Deploy a VPS on Shape.Host

Visit https://shape.host and log into your account.

Click Create, then choose Instance.

Select a server location closest to your users.

Shape.host instance form with the data center location selector highlighted.

Pick Ubuntu 24.04 (64-bit) as the operating system.

Choose a plan with 2+ CPUs, 4 GB RAM, and 20 GB SSD.

Shape.host instance form with the operating system image selector highlighted.

Click Create Instance.

Shape.host instance form with the Create Instance button highlighted.

Once ready, find your IP address in the Resources section to connect.

Shape.host Resources dashboard with the server IP address highlighted.

Step 2: Connect to Your Server

On Linux/macOS:

ssh root@your_server_ip

On Windows, use PuTTY and connect with your server’s IP address as root.

Step 3: Update and Install Nginx

apt update
apt install nginx

Installs Nginx, the web server used in this setup.

Terminal showing APT package management commands and output.

Step 4: Check Nginx Status

systemctl status nginx

Confirms that Nginx is running properly.

Terminal showing systemd service management commands or output.

Step 5: Configure the Firewall

ufw allow 'Nginx Full'
ufw allow ssh
ufw enable

Opens firewall ports for HTTP/HTTPS and SSH access.

Terminal showing firewall configuration commands and rules.

Step 6: Install the Apache Utils Package

apt install apache2-utils

Provides the htpasswd command, which lets you create user/password files.

Step 7: Edit Nginx Configuration

nano /etc/nginx/sites-available/default

Find the server {} block and add this section inside:

location /sensitive-doc {
    auth_basic "Basic Auth";
    auth_basic_user_file /etc/nginx/.htpasswd;
}

This sets up password protection for the /sensitive-doc path.

Terminal showing an HTTP authentication password-file command.

Step 8: Create Username and Password

htpasswd -Bc /etc/nginx/.htpasswd username

You’ll be prompted to enter a password. Replace username with your preferred user.

Step 9: Create the Protected Directory

mkdir /var/www/html/sensitive-doc

This is the folder that will be password-protected.

Step 10: Reload Nginx to Apply Changes

systemctl reload nginx

Reloads Nginx without shutting it down.

Step 11: Add a Test HTML File

nano /var/www/html/sensitive-doc/index.html

Paste the following content:

<html>
<title>My basic authentication HTML page</title>
<body>
<p style="width: 100%; font-weight: bold; font-size: 60px; text-align: center;">
Basic authentication is enabled!
</p>
</body>
</html>

Save and exit the editor.

Terminal showing the GNU nano editor and configuration text.

Step 12: Test It in Your Browser

Visit:

http://your_server_ip/sensitive-doc/

You should see a login prompt. Use the username and password you created to access the page.

Browser HTTP authentication prompt requesting a username and password.

Browser displaying the Basic authentication is enabled test message.

You’ve now protected a directory with Nginx basic authentication on Ubuntu 24.04, using just a few simple commands.

This setup works perfectly on Shape.Host Linux SSD VPS servers:

Fast and reliable performance
Root access and quick provisioning
Ideal for Nginx-based projects

Launch your instance now at https://shape.host