This question is for J3.3+

I'd like to set up my extensions in a password protected directory on one web site.

This will act as repository for customized extensions to be used by several other Joomla! sites.

I'd like to use the 'Install from URL' in the Extension Manager of my other Joomla! web sites to install those packages.

Using a password protected directory breaks this feature and throws an error.

I am considering 2 solutions

1) A 'hack' on the Extension Manager to submit the username/password

2) Restricting access to only specific domains (those could include Joomla! sites on subdomains or external domains)

A combination of both would be ideal as urls are easy to spoof, so the first level of protection would the .htaccess password protected directory, and the second level would be to only allow access from specific URLs.

I am using HostGator on a reseller account.

2 Answers 2


While I'm not sure this is a good idea.

You could use IP restrictions, allowing access only from the IP address of the website you want to have access. This does present an issue if other websites are on the same IP address.


<Limit GET POST> 
 order deny,allow
 deny from all
 allow from
 allow from
 allow from 333.333.333.333

The Limit directive affects the directory it's placed in and sub-directories. You would probably be better off using if you can figure out the exact HTTP that's being used.

  • Thanks for the answer. This might work as I have the option of static IP addresses. Can this be done also for domain and/or subdomain?
    – NivF007
    Commented May 11, 2014 at 11:10
  • Do you mean by the domain/sub-domain that's requesting the file?
    – Craig
    Commented May 11, 2014 at 21:36
  • Yes - by the domain/subdomain - but I might be on the wrong track with this. I think the installer is using the browser as the client - so I'm not sure this approach will work.
    – NivF007
    Commented May 11, 2014 at 21:38
  • The standard Joomla installer's "Install from URL" is performed on the server, I don't have access to the code write now but it uses JHttpFactory in 3.x
    – Craig
    Commented May 11, 2014 at 21:50

You can read carefully through this PR in Github: https://github.com/joomla/joomla-cms/pull/2508 And also to: https://github.com/joomla/joomla-cms/pull/2769

It has been implemented since Joomla! 3.2.2, it basically allows to setup additional parameters in the download URL. It is for updates and not for initial installation, but I think it can work out for you.

So your password protected directory could make a check against params in the URL requested (either 1, 2 or even 3 params).

So you will have: http://example.com/passwordprotecteddirectory/file.zip - requesting this will result in 401 http://example.com/passwordprotecteddirectory/file.zip?user=admin&pass=123456&secretkey=4901 - your server should make the check if these params are allowed to download and return the file if so or again return 401, in case there is no permission.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.