title: Protecting a Subdomain with htaccess
body: <p>I have my own server and do everything on my end as much as possible for a gaming community (in order to keep overhead down).  This includes hosting the website myself with WAMP and Windows 10. Let's say I have a domain. I'm using a REST server for .. stuff. I need to provide access to the REST server via a Web Control Panel that uses a chunk of complicated PHP and Javascript noise to work. The only way to run it is through the server (obviously) which means it needs it's own virtual host to operate (I think. It doesn't work if I just use PHP Include). So I created a subdomain (rest.domain.com) and plugged that into the src for an iframe that I put on a webpage that is password protected. The only problem I'm facing right now is that anyone can go to rest.domain.com and go right around the paltry Wordpress security and mess about with my stuff.</p>
  
  <p>I'm open to either</p>
  
  <ol>
  <li>Blocking direct URL access and including some fancy code so only the iFrame can get to it.</li>
  <li>Passwording the SubDomain and just giving my REST users the rest.domain.com url.</li>
  <li>Something entirely different that I didn't know existed.</li>
  </ol>
  
  <p>What should I do?</p>
  
  <p><strong>EDIT:1</strong></p>
  
  <p>So, we've gotten to the point where we're using an .htaccess file to restrict the subdomain with a login/password.  I've created the .htaccess file in the directory of the REST files and created an .htpasswd file.</p>
  
  <p>I am now receiving 500ISE errors.
  I have gone down through 3 Google Search pages trying to research the issue and have made dozens of edits to my .htaccess file to make it work.  Without the htaccess, the REST server can be accessed without restriction.  The error is in the .htaccess file.  Here is what my .htaccess file looks like upon giving up on this for the evening:</p>
  
  <p>Messing around with this for hours and have gone down 3 Google Pages, opening and researching every single hit (most are on SO) and still stuck on a 500 Internal Server Error.  This is where I'm sitting at right now with my htaccess file and this is where I'm giving up for the night:</p>
  
  <pre><code>AuthType Basic
  AuthName "Locked"
  AuthUserFile o:\..\..\..\..\.htpasswd
  Require valid-user
  
  SetEnvIf Host rest.domain.com !secure_content
  
  Order Allow,Deny
  Allow env secure_content
  Deny From All
  
  Satisfy Any
  </code></pre>
  
  <p><strong>EDIT:1.1</strong></p>
  
  <p>So, instead of giving up (because I ain't no quitta!) I've started noticing a trend from a few other sites that using a far less complicated .htaccess than the "instructional" I originally found.  I went ahead and commented out the following lines:</p>
  
  <pre><code>#SetEnvIf Host rest.radio-takeover.com !secure_content
  
  #Order Allow,Deny
  #Allow env secure_content
  #Deny From All
  
  #Satisfy Any
  </code></pre>
  
  <p>It now appears to be working as intended.  Thank you, Jenny, for somewhat pointing me down the right path.</p>