I have a problem with access to my webstore. So I have a domain example.com and I have a script installed on the public_html folder and it is protected with password since I am accessing the script through url and I don't want anyone who type my url to have access to it.

I installed WordPress in public_html folder just to find out that WordPress index file overrided my script index file and I lost the access to my script. After I uninstalled the WordPress I lost the index file but luckily I had a backup and was able to replace the index file and got the access to the script so it is working fine now. Main reason I got that domain was to build the webstore but I didn't expect that I cant have the script and the webstore on same domain.

After researching I found out that I can install wordpress on subdomain so I created a subdomain webstore.example.com and the folder is public_html/webstore and installed wordpress in that folder.

Since I am new to this I spent numerous hours to build the webstore just to find out later that when trying to access it through the url webstore.example.com it is actually asking for password and this doesn't work for me since my customers don't have the username and password. So my guess is that since the webstore folder is accessible through the public_html folder it is protected from the password that protects that folder.

My question is: What can I do to make my webstore accessible without asking my customers for user and password?

Any help and ideas will be greatly appreciated. Thank you in advance

  • password protecting on the web server level is always a cumbersome thing. You should probably just change your index.php to verify password before giving access. In any case, this is borderline on topic aand probably better asked at the super user stack or some other stack which is more specific to web server configuration Feb 24, 2018 at 6:31

1 Answer 1


Access your site via ftp or cPanel/plesk, making sure that hidden-files are visible.

Find your .htaccess file. Make a backup on the server by copying & renaming (uploading a .htaccess file with the wrong encoding could break it and make things even worse)

Find the lines which start with / look like the following (or thereabouts):

AuthUserFile %variable stuff here%
AuthGroupFile %more variable stuff%
AuthName %variable stuff%
AuthType %variable stuff%
require %variable stuff%

prefix those lines with a bang, hash, pound-sign, or number-symbol (whichever you prefer to call it)

# AuthUserFile %variable stuff here%
# AuthGroupFile %more variable stuff%
# AuthName %variable stuff%
# AuthType %variable stuff%
# require %variable stuff%

If you want, you can look in the file that AuthUserFile points to & change the password to something else.

If you want to remove the password protection from the sub-domain try adding the following to the .htaccess file in the sub-domain directory:

# allows any user to see this directory
Satisfy Any

Please note that the syntax changed in Apache 2.4, this should have the same effect

Require all granted

ref: https://stackoverflow.com/questions/1431378/how-to-remove-htaccess-password-protection-from-a-subdirectory

  • 1
    the OP want to keep protecting the root domain while enabling the subdomain. Seems like your answer just removes all protection. Feb 24, 2018 at 6:33
  • Perhaps OP should provide a stackoverflow.com/help/mcve then. They said "Any help and ideas will be greatly appreciated"
    – admcfajn
    Feb 24, 2018 at 15:30
  • "any help with idea" should be done in the comments. Answers should be answers to the question (or full explanation why it is a bad idea) not just a partial suggestion. Feb 24, 2018 at 16:11
  • @MarkKaplun Yes & no. If there's no room for the explanation in a comment then an answer can be a decent substitute. At the end of the day, it's up for the community to decide, I've found wp.se to be much less strict than so. Either way, thanks for flagging, I've elaborated my response.
    – admcfajn
    Feb 24, 2018 at 16:49
  • To a point yes, partial answers are fine as long as they have enough beef, but in this case assuming the OP have no clue about how to handle htaccess changes (except for what he can copy and paste), it was just not helpful enough to be of much use. Feb 24, 2018 at 17:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.