# Restrict access to your Discourse site with HTTP Basic Authentication

**URL:** https://meta.discourse.org/t/restrict-access-to-your-discourse-site-with-http-basic-authentication/168192
**Category:** Sysadmins
**Tags:** how-to
**Created:** [October 23, 2020, 4:28pm UTC](https://meta.discourse.org/t/restrict-access-to-your-discourse-site-with-http-basic-authentication/168192 "2020-10-23T16:28:18Z")
**Posts on this page:** 1
**Showing post:** 1

<div class="post-metadata">

### Author: ![pfaffman](https://sea3.discourse-cdn.com/meta/user_avatar/meta.discourse.org/pfaffman/32/120154_2.png) [@pfaffman](https://meta.discourse.org/u/pfaffman)
#### Post date: [October 23, 2020, 4:28pm UTC](https://meta.discourse.org/t/restrict-access-to-your-discourse-site-with-http-basic-authentication/168192/1 "2020-10-23T16:28:18Z")

</div>

Sometimes you don’t want the general public to be able to access your Discourse instance quite yet, like when you’re staging a site for a migration.

NOTE: I have had some trouble with basic-auth recently in which some static assets weren’t getting loaded. It might be easier to just configure your site for `login_required` by adding `DISCOURSE_LOGIN_REQUIRED: true` in the `env` section of your `app.yml`.

The following setup will put up a simple browser confirm dialog asking for username and password, common to **all** visitors, that will be required before they can access the site.

> ℹ Note: Users will still need to perform normal Discourse registration and login.

### basic auth credentials

### Generate encrypted password

```
htpasswd -bn =username= =password=

```

Note: You’ll need `htpasswd` for this. In Ubuntu/Debian, it is in `apache2-utils`. If you have access to some other machine with `htpasswd` installed, you can just run it there. If your goal is merely to keep out search engines, there is no reason not to use the example password here.

### encrypted user/password goes here

### Add to `app.yml`

```plaintext
# basic auth
  after_bundle_exec:
    - replace:
       filename: "/etc/nginx/conf.d/discourse.conf"
       from: "# auth_basic on"
       to: "auth_basic on"
    - replace:
       filename: "/etc/nginx/conf.d/discourse.conf"
       from: "# auth_basic_user_file /etc/nginx/htpasswd"
       to: "auth_basic_user_file /etc/nginx/htpasswd"
    - replace:
       filename: "/etc/nginx/conf.d/discourse.conf"
       from: "location = /srv/status {"
       to: "location = /srv/status {
           auth_basic off;"
    - file:
       path: "/etc/nginx/htpasswd"
       contents: |
         =auth_string=    

```

The `after_bundle_exec` section changes the configuration of the nginx inside the discourse container. When you’re ready to go live, just delete this section and rebuild.

---

_[View the full topic](https://meta.discourse.org/t/restrict-access-to-your-discourse-site-with-http-basic-authentication/168192)._