HTTP Basic Authentication can protect staging sites, internal test pages exposed through a public endpoint, and other non-public web routes. Uptime Basics can include a Basic Authentication username and password with each check.
Before you begin
Use an HTTPS URL. Basic Authentication encodes the username and password for the HTTP request, while HTTPS provides the encrypted connection that protects them in transit.
Create a dedicated monitoring credential with only the access needed to load the monitored endpoint. Do not reuse an administrator password or place credentials directly in a URL such as https://user:password@example.com; URLs with embedded credentials are not accepted.
Configure Basic Authentication
When creating a monitor:
- Open New Monitor.
- Enter the site name and HTTPS URL.
- Find Advanced request options.
- Set Authentication to Basic authentication.
- Enter the authentication username and password.
- Finish the monitor settings and select Create Monitor.
For an existing monitor, open Advanced Request Options, choose Basic authentication, enter the credentials, and save the changes.
The username and password fields remain disabled while No authentication is selected.
How saved credentials are handled
Saved request credentials are protected at rest and are used only to perform the monitor request. The saved password is not returned to the browser or shown on the monitor page.
When editing an existing Basic Authentication monitor, leave the password field blank to keep the saved password. Enter a new password only when you want to replace it. Selecting No authentication and saving removes Basic Authentication from future checks.
For security, credentials are not forwarded if a redirect changes to a different origin. Same-origin redirects can continue using the saved credentials.
If authentication still fails
Confirm that:
- the URL uses HTTP Basic Authentication rather than a website login form;
- the username and password are current;
- the credential has permission to access the exact path;
- the endpoint is reachable over public HTTP or HTTPS;
- a redirect is not moving the request to a different origin;
- the site is not requiring cookies, JavaScript, a one-time code, or another interactive login step.
An HTTP 401 result normally means the server did not accept the credentials. See HTTP 401 authentication required or contact Uptime Basics support if the problem continues.