I have inherited an ExpressionEngine site and need to add a password-protected subdomain. The original htaccess file in the root directory was...

<IfModule mod_rewrite.c>
    RewriteEngine On
    RewriteBase /

    # Removes index.php from ExpressionEngine URLs
    RewriteCond %{THE_REQUEST} ^GET.*index\.php [NC]
    RewriteCond %{REQUEST_URI} !/system/.* [NC]
    RewriteRule (.*?)index\.php/*(.*) /$1$2 [R=301,NE,L]

    # Directs all EE web requests through the site index file
    RewriteCond %{REQUEST_FILENAME} !-f
    RewriteCond %{REQUEST_FILENAME} !-d        
    RewriteRule ^(.*)$ /index.php?/$1 [L]

...but when password protection was added to the subdomain, users could click "cancel" and then the page contents would become visible.

I added...

RewriteCond %{HTTP_HOST} !^mysubdomain\. [NC]

...to the second rewrite rule, and that allowed the password protection to work normally for the subdomain homepage; however, none of the pages or subdirectories in that subdomain work now. It looks like all the page resources are getting URLs like: "http://mysubdomain.domain.com/{site_url}images/uploads/core-images/image.png"

How can I get the password protection working properly without breaking the URLs so that the rest of the subdomain pages and subdirectories will work properly?

  • Nothing is clear here. What is your web root structure? That is super important for us to help you. Please leave out identifying directory or file names. Are your domains all siblings? Do you have a main domain directory and everything else is a child directory and .htaccess from the main domain does the initial redirection?
    – jrothafer
    Commented Mar 13, 2019 at 10:42
  • @jrothafer, The htaccess rules above are in the root directory, e.g. domain.com. An htaccess file in mysubdomain.domain.com (a subfolder, e.g. domain.com/mysubdomain) specifies the username and password to access that subdirectory.
    – supernaut
    Commented Mar 13, 2019 at 13:46
  • Without excluding 'mysubdomain' in the main htaccess file, the password protection doesn't work properly; clicking cancel allows users to see the supposedly protected page contents. But when I exclude 'mysubdomain' in the main htaccess file, the EE rewrites aren't working properly within the subdirectory. It appears that EE is creating links with the structure 'domain.com{site_url}images/uploads...etc. Basically the base URL is included twice.
    – supernaut
    Commented Mar 13, 2019 at 13:46
  • Could provide a copy of the .htaccess file that contains the buggy code (rather than giving examples of code you are not using). Commented Mar 17, 2019 at 11:05
  • That's the exact code, above, with the exception of the real subdomain.
    – supernaut
    Commented Mar 18, 2019 at 14:11

1 Answer 1


After much searching, we abandoned the htaccess route and went with EE's template access restrictions: https://devot-ee.com/articles/item/using-ee-built-in-http-authentication-for-restricting-development-access.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.