Monitor websites behind HTTP basic authentication

Is your site behind a username and password popup from the browser? That's HTTP basic authentication, and you can still monitor it with Oh Dear. You add one Authorization header to your monitor, and we send it with every request.

What is HTTP basic authentication? #

HTTP basic authentication, or "basic auth", is the simplest way to put a password on a website. Your browser shows a small popup that asks for a username and a password. You'll often see it on staging sites and internal tools.

After you log in, your browser sends your credentials with every request in an Authorization header. The value is the word Basic, followed by your username and password. They're joined by a colon and encoded with base64.

Without that header, the site answers with 401 Unauthorized. Our uptime check treats that as downtime.

Create the Authorization header #

You can build the header value on the command line. Replace username and password with your own credentials.

$ echo -n 'username:password' | base64
dXNlcm5hbWU6cGFzc3dvcmQ=

Put Basic and a space in front of the result. This is the header you'll add to Oh Dear:

Rather not use the command line? Log in to the site in your browser and open the developer tools. Go to the Network tab, reload the page and click the first request. You'll find the Authorization header under Request Headers. Copy its full value, including Basic.

Add the header to your monitor #

Request headers are set per check. Add the header to every check that needs to log in:

• Uptime: open the settings of the uptime check. In the Requests section, open the Headers tab and add the header.
• Broken links, mixed content and sitemap: these three checks share one list of request headers. Add the header in the Request headers section of any one of them.
• Lighthouse and application health: each has its own request headers in its settings.

Save, and we'll send the header with every request of that check. Your checks log in on each run, just like your browser does.

Good to know #

• Base64 is an encoding, not encryption. Anyone who sees the header can decode your username and password. We recommend a separate user that you only use for monitoring.
• Changed the password? Update the header in Oh Dear too. Otherwise your checks get a 401 response and report your site as down.
• The broken links crawler sends your headers with every request it makes. If you turned on Include external links, the Authorization header goes to those external sites too. Leave that setting off for a site behind basic auth, unless that's fine for you.
• A few headers can't be overwritten, like User-Agent. Authorization isn't one of them. You'll find the full list under custom HTTP headers.