Shopware Password Protection with .htaccess

Introduction

If you want to protect directories of your Shopware installation and/or your online store (e.g., the entire Shopware storefront) with HTTP Basic Authentication, our guide will show you how to set this up on your Shopware or Plesk server.

Prerequisites

Shopware installation
Plesk Control Panel

Create a Username and Password (.htpasswd)

First, connect to your Plesk server via SSH using the SSH user associated with your subscription:

ssh musteruser@sXXXXX.creolineserver.com

Now use the following command to create a .htpasswd file with the desired username and password. Replace <Domain> with your subscription and musteruser with the desired username. Then enter the desired password and confirm your entry by re-entering the password:

htpasswd -c /var/www/vhosts/<Domain>/.htpasswd musteruser
New password:
Re-type new password:

Customizing the .htaccess File in the Plesk Control Panel

First, log in to the Customer Center at account.creoline.com using your login credentials, and then log in to the Plesk Control Panel on the desired server. The following Help Center article shows you how to log in to the Plesk Control Panel: Logging in to the Plesk Control Panel

Next, select the "Files" menu item for your Shopware domain to open the document root of your Shopware store.

Next, click the .htaccess file in the File Manager to edit it via the Plesk Control Panel, and use the cursor to navigate to the end of the file so that the changes are inserted below the standard Shopware instructions.

Add the following content to the .htaccess file to ensure that password protection is applied only to the Shopware storefront; otherwise, this will cause issues with Shopware’s administration and integrated API. Replace the placeholder <Domain> with your corresponding subscription:

AuthName "Administrator’s Area"
AuthType Basic
AuthUserFile /var/www/vhosts/<Domain>/.htpasswd
require valid-user

SetEnvIf Request_URI /api noauth=1
<RequireAny>
Require env noauth
Require env REDIRECT_noauth
Require valid-user
</RequireAny>

SetEnvIf Request_URI /admin noauth=1
<RequireAny>
Require env noauth
Require env REDIRECT_noauth
Require valid-user
</RequireAny>

SetEnvIf Request_URI /product-api noauth=1
<RequireAny>
Require env noauth
Require env REDIRECT_noauth
Require valid-user
</RequireAny>

SetEnvIf Request_URI /store-api noauth=1
<RequireAny>
Require env noauth
Require env REDIRECT_noauth
Require valid-user
</RequireAny>

Save the file for the changes to take effect, and finally test them by making the following requests. Again, replace musterdomain.tld with the actual domain of your store:

Access the Shopware storefront (e.g., https://musterdomain.tld)
Access the Shopware admin backend (e.g., https://musterdomain.tld/admin)

You should be prompted to enter a username and password on your first visit.