401 Unauthorized: What It Means and How to Fix It (401 vs 403)

Applies to: password-protected folders (Apache .htpasswd, cPanel Directory Privacy, Nginx auth_basic) and APIs; tested with Apache 2.4.68 and Nginx 1.31.6

401 Unauthorized means the page or API needs you to log in, and you sent no login details or wrong ones. The server includes a WWW-Authenticate header that says how to log in; for a password-protected folder, the browser then shows a username and password box. In our tests, both Apache and Nginx answered:

HTTP/1.1 401 Unauthorized
WWW-Authenticate: Basic realm="Members only"

With the correct username and password, the same request returned 200.

401 or 403?

• 401: “who are you?” Log in, or log in again.
• 403 Forbidden: the server knows the request but refuses it, for example because of file permissions, an IP block or missing rights. Logging in again usually doesn’t help. See how to fix 403 errors.

If you are a visitor

• Check the username and password; both are case-sensitive.
• Browsers remember the login for the session; close all browser windows (or use a private window) to try again with other details.
• On sites with a normal login page, your session may have expired: sign in again.

If you call an API

• The API key or token is missing, wrong or expired. Most APIs expect Authorization: Bearer <token>; some use a custom header or basic authentication.
• Test outside your code:

  curl -i -H "Authorization: Bearer YOUR_TOKEN" https://api.example.com/me
  curl -i -u username:password https://example.com/private/

• Time-based tokens fail when the server clock is wrong; check that NTP is running.

If it is your password-protected folder

1. In cPanel, Directory Privacy manages the folder password and users: password protect a directory in cPanel. Reset the user’s password there.
2. With your own .htaccess, check that AuthUserFile points to the full path of an existing .htpasswd file.
3. Create or update users with htpasswd (package apache2-utils or httpd-tools):

   htpasswd -c /home/user/.htpasswd alice   # -c creates a NEW file (replaces an existing one)
   htpasswd /home/user/.htpasswd bob        # add or change a user in an existing file

4. Protecting the WordPress login: password protect wp-login.php.