I have a static HTML website that being served by Apache 2.4 using SSI. I have been using basic authentication to control access to a subset of files and it has stopped behaving as expected. Essentially all I want to do is require a username / password for some parts of the website. I've included what I think is the relevant configuration with some names changed to protect privacy.

/etc/apache2/sites-enabled/example.conf

```
<VirtualHost *:80>
    ServerName site.example.com:80
    ServerAdmin webmaster@localhost

    DocumentRoot /var/www/site
    <Directory /var/www/site/>
        Options Includes Indexes FollowSymLinks MultiViews
        AllowOverride All
        Require all granted
    </Directory>
    ErrorLog /var/log/apache2/error.log
</VirtualHost>

```

/var/www/site/.htaccess

```
AuthType        Basic
AuthName        "Site Access Control"
AuthBasicProvider   file
AuthUserFile   /var/www/site/passwords

```

/var/www/site/dir1/dir2/protected-dir/.htaccess

```
require valid-user

```

As I understand it, I have configured the site directory for my virtual host. At the top level directory I have configured basic authentication. In those directories where I wish to control access I require a valid user. The .htaccess files should combine accordingly.

When I browse to:

```
 site.example.com/dir1/dir2/protected-dir

```

I am granted access to the page and its contents are visible. This is not what I expect. In the Apache2 error log, I get the following:

```
[Sat Jul 04 11:03:12.073970 2015] [deflate:debug] [pid 19576] mod_deflate.c(855): [client 192.168.50.242:63254] AH01384: Zlib: Compressed 3036 to 656 : URL /dir1/dir2/protected-dir/index.shtml, referer: http://site.example.com/dir1/dir2/
[Sat Jul 04 11:03:12.095014 2015] [authz_core:debug] [pid 19576] mod_authz_core.c(802): [client 192.168.50.242:63254] AH01626: authorization result of Require valid-user : denied (no authenticated user yet), referer: http://site.example.com/dir1/dir2/protected-dir/
[Sat Jul 04 11:03:12.095044 2015] [authz_core:debug] [pid 19576] mod_authz_core.c(802): [client 192.168.50.242:63254] AH01626: authorization result of <RequireAny>: denied (no authenticated user yet), referer: http://site.example.com/dir1/dir2/protected-dir/
[Sat Jul 04 11:03:12.095721 2015] [authz_core:debug] [pid 19576] mod_authz_core.c(802): [client 192.168.50.242:63254] AH01626: authorization result of Require valid-user : granted, referer: http://site.example.com/dir1/dir2/protected-dir/
[Sat Jul 04 11:03:12.095741 2015] [authz_core:debug] [pid 19576] mod_authz_core.c(802): [client 192.168.50.242:63254] AH01626: authorization result of <RequireAny>: granted, referer: http://site.example.com/dir1/dir2/protected-dir/
[Sat Jul 04 11:03:12.095994 2015] [deflate:debug] [pid 19576] mod_deflate.c(855): [client 192.168.50.242:63254] AH01384: Zlib: Compressed 1397 to 481 : URL /dir1/dir2/protected-dir/style.css, referer: http://site.example.com/dir1/dir2/protected-dir/

```

Can you determine what is wrong with my configuration?