i have several drupal sites running as multisite (same core + modules code), just moving to shared hosting

Some sites should be kept password protected. (AuthType Basic)

Is there a way to tell in .htaccess in drupal root that for certain HOSTNAME's
the password section should apply or at least a new .htaccess (in site subfolder) shall override .

2 Answers 2


Apache does not support this. You can use REWRITECOND to conditionally match rewrite rules, but there is no way to conditionally hide AuthType directives, except to separate the Drupal sites into different Drupal root folders. Putting an .htaccess file in the sites/mysite folder won't work, because settings.php is read via php, not served up by the webserver.

Use Drupal features to protect your content. If you turn off the "Access Content" permission for anonymous users, then a Drupal login will be required to view any page; all others will get "Access Denied".

  • thx, so I made a 2nd root folder with the few projects I have under apache basic auth. THey can share the same htpasswd file, that's no prob. I preferred it over modifying the drupal access rules in these cases. Sep 21, 2012 at 11:12

The Shield module allows you to store HTTP access settings in the database on a site-by-site basis. Just enable the module for the sites you want protected.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.