How to Password Protect Web Pages/Website

How to Password Protect Web Pages/Website

Some parts of your web site may be private. So how do you restrict access to those web pages?  The answer is to password protect those pages. Anyone who wants access is then required to enter a valid username and password in order to view them.

Membership websites either paid of free (requiring registration) typically require a password to be entered in order to view certain web pages.

However you don't need to be providing a membership website in order to require access restrictions on some web pages. You may have a family website for family members only, or a download area that you want to restrict access to.

Password Protection Methods

There are two main ways password protect is achieved

• Using scripting (Usually JavaScript but php and asp can be used)
  
• Using Server based password protection.
  

Using JavaScript Scripting

This type of password protection doesn't require anything special on the server but does require that the the browser support and enable JavaScript.

Generally the way these pages work is to send the user to a opening page that requires the username/password to be entered. If they enter it correctly they are then re-directed to the correct page.

They can be very simple scripts with the username and password embedded in the page but only viewable in source mode to more complex ones where the password/username is encrypted and hence more secure. You can also get scripts that support multiple users.

Here is an example of a script in action. The username is steve and the password in password. Click to reset

the example is

Here is the script  that checks for the username and password I've highlighted the username and password in yellow:

<script language="javascript"> <!-- /*Change the usename,password and the page to redirect the user to to suit your own site*/ function login(form)  { if (form.user.value=="steve" && form.password.value=="password") { location="encrypt1.htm" } else { alert("Invalid username or Password") } } //--> </script>

For increased security you should implement it as an external script. Here is the script and form page (opens in new window). Just view the source and copy the contents, and edit as needed. There are many other scripts available here.

Although they are very simple to implement they are not really that secure as once the visitor has visited the real page he can book mark it and return without going through the login page.

There are commercial scripts available like htmlock which are designed for protecting multiple files and overcome the above problems by encrypting the web pages. These also introduce their own difficulties, as the files are encrypted and can only be edited by decrypting them.

PHP and ASP Scripts

These are similar to the JavaScript examples but instead the scripts are run on the server and hence require that the server supports that script. Each page that requires protection needs to be edited to include the script. Here is a free php script if you want to investigate further.

Server based Password Protection

This is by far the best and most secure option. However it does require that your host supports it. Your Hosting provider will provide control through a control panel where you can configure the protected directories and username/passwords.

The problem with this approach is that it requires manual setup and is only really used in a semi-static environment. Meaning there aren't many users and they don't change often. It is often used to provide access for newsletter readers (and similar) to private parts of a site. The trick to keeping it secure being to change the password regularly and notify the members by email of the password change.

For a more complex membership type system, were the visitor can create and edit his own username and password, you need a fully fledged membership site system. These are normally written in php, perl or asp and usually require database (MYSQL, SQL or access) support.

You should ensure that your host supports the necessary components before you purchase a membership system.