how do I set up a secure page on my website?

[#1]

Hi David, I went onto my website from my workplace today & yes, you're right the password box reappeared once more. I don't think that the file size has changed. At the moment the file size for .htaccess on my remote site (RH pane in FileZilla) is 132 & on my local site (LH pane) htaccess.txt is 136.
Kmilburn, many thanks for your observations & input but I can make little sense of your reply, please remember that I need really simple, to understand answers. Are you suggesting that I contact PN support for them to explain the error log (sorry to sound so dim)?
Just a thought. As I've tried to create a password & username more than once, although I've always deleted the htaccess & htpasswd files both on my local & remote sites, is there any chance that a previously sent up, different, (as I've set up a different one each time)
username & password could be still linked to my account. As I try to log on using my latest username & password could that be causing the server 500 error code?
Do you know of anyway for me to check the stored username & password ?
Best regards & thanks for your help.         

[#2]

From  a quick experiment,  it appears the AuthUserFile path in your htaccess file is incorrect.
The sever will generate a 500 error if it cannot locate the .htpasswd file.

[#3]

Well done.
Might not be the AuthUserFile path, could be that the .htpasswd file doesn't exist or is incorrectly named.
I've replicated the internal server error 500 problem on my site by renaming .htpasswd so the server wouldn't find it.

[#4]

I just love when you have two experts in dispute How do I put this right. Should I delete/remove both the htaccess & htpasswd files & start again? 
Have you any other ideas?
Best regards, Mick

[#5]

Hi Mick,
The "two experts" as you kindly refer to us are not in dispute - the opposite is the case.
Both of us suggested the server 500 error was likely to be associated with the same problem, namely that Apache (the web server) was unable to interpret the AuthUserFile instruction to determine if access should be allowed so generated the generic error 500 signal instead. That could be because the path /share/isp/.../.htpasswd is incorrect, or the path is correct but the .htpasswd file doesn't exist or its contents are not correct.
Rather than deleting both files I suggest using FileZilla to rename .htaccess and .htpasswd on the remote site (only) to a.htaccess and a.htpasswd (add 'a' in front of each dot, don't change anything else), so that I can take a look.
I've assumed that you are a customer of Plusnet rather than Force9, etc - is that correct? The path will be different for the other vISPs which would lead to getting that error
David

[#6]

Another possibility: file was upload as binary rather than text.

[#7]

I don't think Mick will understand what that means, but since the .htaccess file shrunk by 4 bytes the transfer must have been text. The same should be true for .htpasswd but it's one thing I'll be checking if I get the opportunity.

[#8]

Hi David, I was only joking. I think that it's great that both of you are having a look at it for me. David you were dead right about your assumption of my understanding but thanks all the same jelv. Keep at it guys. I'll try your suggestions shortly.
Many thanks.
Mick

[#9]

A change in 4 bytes on .htaccess is likely  a conversion from windows to unix line endings,  which implies text transfer and is to be expected.

[#10]

Hi David, I've renamed the files on the remote site as you've suggested with an 'a' in front of the dot. Filezilla confirmed the rename as successful. I haven't tried my website 'members' tab as I didn't want to interfere with whatever you're trying to achieve. I am a PN customer & for many years a very happy one. I can never understand when people level such serious complaints towards PN, maybe their needs are much greater than mine.
Just let me know what you want me to do at this end.
Best regards & best of luck.
Mick
PS: kmilburn, I'll listen & try to understand whatever you say, thanks for your input. 

[#11]

Hi Mick,
Thanks for doing that, saved us a bit of to-ing and fro-ing.
The AuthUserFile path is indeed incorrect as kmilburn suggested. You need to change the word "path" towards the end of the string to "newdir" so that the path ends .../htdocs/newdir/.htpasswd
Make this change to htaccess.txt on your own computer using Notepad, save the file then upload it again to /htdocs/newdir using FileZilla.
Rename this file on the remote site to .htaccess and delete the file currently called a.htaccess
Rename a.htpasswd on the remote site back to .htpasswd (ie remove the 'a').
Then try browsing to the members area of your website again.
Hopefully you'll be asked for the username and password again but this time entering these will allow access.  
Kind regards
David

[#12]

David....now I'm impressed! It works. Congratulations & well done. I really think that you should rewrite the article on how to password protect a website. What we have created is how to password protect a page/folder within a website & not just the website. Many thanks also to all that have contributed towards this, especially kmillburn. David if you are going to write an article on this for the library & want some input from the 'dummies' side of things, I'd glady help.
Thanks again & no doubt I'll talk to you again.
Best regards, Mick.

[#13]

Hi Mick, it's been a bit of a tortuous journey but I'm delighted we got there in the end.
Hopefully it will be obvious what changes are needed if you don't want the protected folder to be called 'newdir' - don't forget to change the path in .htaccess if you change the folder name.
Also you need to ensure the folder contains an index.htm file so that visitors can't list folder contents - though that ability has been very helpful for me. (Preventing indexing could be done using .htaccess but I don't want to complicate this - just ensure folders always contain an index.htm file.)
Thanks for your comments about the article. The first line originally said "To password protect a particular folder in your webspace, follow these steps:", but the article didn't explain why that objective differed from the title. I've added an introductory paragraph which hopefully covers that.
I've also changed the .htaccess 'substitution' explanations to make it clearer that the name of the folder replaces path in the model text, added an explanation of CHMODing and a note at the bottom concerning 500 internal server errors.
Hopefully the changes will provide better guidance for novice users but suggestions for further improvement are welcome.
Kind regards, David

[#14]

Well done David & once again many thanks.
Best regards,
Mick

[#15]

Hi David, my Members page within the secure folder is operating well so don't panic. How could I set up a message board/page within the same folder so that each member could add to it should they wish to do so? I've seen messages on the forums from others, calling them something like, 'Wiki-pages'.
Do you think that I'm being a bit ambitious?
I've also forgotten my password for the forums, luckily I have one laptop always logged in. How can I retreive it?
Best regards, Mick