# Securing your Mautic installation against unauthorized connections

**URL:** <https://forum.mautic.org/t/securing-your-mautic-installation-against-unauthorized-connections/25563>\
**Category:** General Discussion\
**Created:** [September 30, 2022, 10:00pm UTC](https://forum.mautic.org/t/securing-your-mautic-installation-against-unauthorized-connections/25563 "2022-09-30T22:00:44Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![Nick\_J](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/nick_j/32/8369_2.png) [@Nick\_J](https://forum.mautic.org/u/Nick_J)\
**Post date:** [September 30, 2022, 10:00pm UTC](https://forum.mautic.org/t/securing-your-mautic-installation-against-unauthorized-connections/25563/1 "2022-09-30T22:00:44Z")

</div>

It is preferable to protect the Mautic login page against unauthorized login attempts, SQL injection attempts or attempts to discover the administrator password using a brute force attack script.

The best way is to use 2nd authentication via an htpasswd file to prevent access to the login page of your Mautic installation.

This tutorial works for apache 2.4

**Step 1**  
Create a .htpasswd file  
Following command will creates a new file and stores a record in it for user jerry. The user is prompted for the password. If the file exists and cannot be read, or cannot be written, it is not altered and htpasswd will display a message and return an error status.

`# htpasswd -c /etc/apache2/.htpasswd jerry`

**Step 2**  
In your VirtualHost from your config file: **/etc/apache2/sites-available/mautic.conf**

Write this:

```auto
	 <Location /s/login>
	 	AuthUserFile /etc/apache2/.htpasswd
	 	AuthName "Username and password required"
	 	AuthType Basic
	 	Require valid-user
	 </Location>

```

The complet version:

```auto
<VirtualHost *:443>
	 DocumentRoot /var/www/html/mautic
	 ServerName mautic.domaine.com

	 <Location /s/login>
	 	AuthUserFile /etc/apache2/.htpasswd
	 	AuthName "Username and password required"
	 	AuthType Basic
	 	Require valid-user
	 </Location>

	 <Directory /var/www/html/mautic/>
		Options +FollowSymlinks
		AllowOverride All
		Require all granted
	 </Directory>

	 ErrorLog ${APACHE_LOG_DIR}/error.log
	 CustomLog ${APACHE_LOG_DIR}/access.log combined
</VirtualHost>

```

**Step 3**  
Check your config apache

```auto
# apachectl configtest
# Syntax OK

```

**Step 4**  
Restart apache2

`# systemctl restart apache2`

---

<div class="post-metadata">

**Author:** ![johnwick](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/johnwick/32/3279_2.png) [@johnwick](https://forum.mautic.org/u/johnwick)\
**Post date:** [October 15, 2022, 11:43pm UTC](https://forum.mautic.org/t/securing-your-mautic-installation-against-unauthorized-connections/25563/2 "2022-10-15T23:43:40Z")

</div>

Another option would be to use Cloudflare’s Access feature located in the Zero Trust panel. Based on the policy you set, it can act as two-factor authentication to lockdown the whole domain or just parts of it like the administrator directory.

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [October 17, 2022, 6:24am UTC](https://forum.mautic.org/t/securing-your-mautic-installation-against-unauthorized-connections/25563/3 "2022-10-17T06:24:46Z")

</div>

I’m wondering ig you tracking works after this.

---

<div class="post-metadata">

**Author:** ![Nick\_J](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/nick_j/32/8369_2.png) [@Nick\_J](https://forum.mautic.org/u/Nick_J)\
**Post date:** [October 17, 2022, 11:44am UTC](https://forum.mautic.org/t/securing-your-mautic-installation-against-unauthorized-connections/25563/4 "2022-10-17T11:44:47Z")

</div>

> [@Nick\_J](#):
>
> `/s/login`

Hello,  
Yes of course, tracking still works.  
The htpasswd simply limits access to the login form accessible at the following address “/s/login”.

---

<div class="post-metadata">

**Author:** ![joeyk](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mautic.org/joeyk/32/11164_2.png) [@joeyk](https://forum.mautic.org/u/joeyk)\
**Post date:** [October 17, 2022, 1:30pm UTC](https://forum.mautic.org/t/securing-your-mautic-installation-against-unauthorized-connections/25563/5 "2022-10-17T13:30:12Z")

</div>

Cool, thx!