|
HTTP basic auth is vulnerable to brute forcing and the lack of a logging interface can make it hard to audit access.
To answer the question, it really depends on what you're trying to protect. A development site? It's probably enough.
If you're opposed to Cloudflare, have your host setup ModSecurity with OWASP rules. A WAF is pretty much the most important part of this equation, to be honest.
My software, LoginBlue, might be able to help though, depending on your use case. It's a replacement for HTTP basic auth written in PHP that uses two-factor authentication via email to confirm access. It works with Apache and it's tested with Nginx. It runs against an existing user database, so it's a drop-in replacement depending on your CRM or AMS. Paired with a WAF, it's fairly robust. I've had great feedback from clients who use it.
|