[Rushax]

I have several dev sites for clients that are password protected using .htaccess combined with a .htpasswd file from the root/.htpasswd.

Is this enough security for it not to be accessible?
I've been looking around at several ways to bypass the .htpasswd using Live HTTP Headers and sending the request again as it says in this guide: https://www.hackthis.co.uk/forum/hacking...entication

However they've set the .htaccess up differently without the last line of

Code

require valid user

The .htaccess I have for blocking (with edits) is:

Code

ErrorDocument 401 "Denied"
ErrorDocument 403 "Denied"

# Allow plugin access to admin-ajax.php around password protection
<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>

AuthType Basic
AuthName "Secure Area"
AuthUserFile "/home/root/.htpasswds/.htpasswd"
require valid-user

All I want to find out is whether this method is secure enough?
~With the exception of using a bruteforce attack.