{"id":2415,"date":"2025-09-20T10:34:42","date_gmt":"2025-09-20T03:34:42","guid":{"rendered":"https:\/\/mahfudly.com\/?p=2415"},"modified":"2025-09-20T10:56:18","modified_gmt":"2025-09-20T03:56:18","slug":"cara-mengunci-situs-staging-sebelum-launch-robots-txt-basic-auth","status":"publish","type":"post","link":"https:\/\/mahfudly.com\/en\/cara-mengunci-situs-staging-sebelum-launch-robots-txt-basic-auth\/","title":{"rendered":"Cara Mengunci Situs Staging Sebelum Launch (robots.txt + Basic Auth)"},"content":{"rendered":"<p class=\"wp-block-paragraph\">Sebelum meluncurkan situs ke publik, praktik terbaik adalah menutup akses publik dan crawler. Di bawah ini langkah urutannya \u2014 mudah diikuti, lengkap dengan file yang bisa Anda copy\u2013paste.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>Ringkasan singkat:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Buat <code>robots.txt<\/code> (blok semua bot).<\/li>\n\n\n\n<li>Temukan path absolut server dengan <code>phpinfo.php<\/code>.<\/li>\n\n\n\n<li>Buat file <code>.htpasswd<\/code> (username:hash) di lokasi aman.<\/li>\n\n\n\n<li>Tambahkan blok Basic Auth ke <code>.htaccess<\/code> di root domain.<\/li>\n\n\n\n<li>Tes lalu hapus file sementara (<code>phpinfo.php<\/code>) setelah selesai.<\/li>\n<\/ol>\n<\/blockquote>\n\n\n\n<hr class=\"wp-block-separator has-alpha-channel-opacity\"\/>\n\n\n\n<h2 class=\"wp-block-heading\">1) Buat <code>robots.txt<\/code> untuk memblokir semua crawler<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Letakkan <code>robots.txt<\/code> di root domain (contoh path di Hostinger):<br><code>\/home\/&lt;USER&gt;\/domains\/contoh.com\/public_html\/robots.txt<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Isi file (<code>robots.txt<\/code>):<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>User-agent: *\nDisallow: \/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Langkah (File Manager):<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Buka Hostinger \u2192 File Manager \u2192 <code>domains\/contoh.com\/public_html<\/code>.<\/li>\n\n\n\n<li>Click <strong>New file<\/strong> \u2192 beri nama <code>robots.txt<\/code>.<\/li>\n\n\n\n<li>Paste isi di atas \u2192 Save.<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Verifikasi:<\/strong> buka <code>https:\/\/contoh.com\/robots.txt<\/code> \u2014 harus menampilkan dua baris di atas.<\/p>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Catatan: <code>robots.txt<\/code> hanya permintaan sopan ke crawler (Google, Bing akan patuh). Untuk keamanan nyata (mencegah akses publik) tetap gunakan Basic Auth.<\/p>\n<\/blockquote>\n\n\n\n<h2 class=\"wp-block-heading\">2) Temukan path absolut server (bantu agar <code>AuthUserFile<\/code> benar)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Kita perlu path absolut ke file <code>.htpasswd<\/code> (mis. <code>\/home\/u1234567\/.htpasswd<\/code>). Cara paling mudah adalah membuat file PHP sementara.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Buat file <code>phpinfo.php<\/code> pada folder root domain:<\/strong><br><code>\/home\/&lt;USER&gt;\/domains\/contoh.com\/public_html\/phpinfo.php<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Isi file <code>phpinfo.php<\/code>:<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\necho \"SCRIPT_FILENAME: \" . __FILE__ . \"\\n\\n\";\nphpinfo();\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Langkah:<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Buat file <code>phpinfo.php<\/code> lewat File Manager, paste kode di atas, simpan.<\/li>\n\n\n\n<li>Akses <code>https:\/\/contoh.com\/phpinfo.php<\/code> di browser.<\/li>\n\n\n\n<li>Perhatikan baris <code>SCRIPT_FILENAME<\/code> or <code>DOCUMENT_ROOT<\/code> \u2192 catat path absolut, contoh:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/home\/u1234567\/domains\/contoh.com\/public_html\/phpinfo.php\n<\/code><\/pre>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li>Dari contoh path di atas, lokasi yang aman untuk <code>.htpasswd<\/code> biasanya:<\/li>\n<\/ol>\n\n\n\n<pre class=\"wp-block-code\"><code>\/home\/u1234567\/.htpasswd\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>PENTING:<\/strong> setelah mendapat path, <strong>hapus<\/strong> <code>phpinfo.php<\/code> segera (mengungkap info server rawan disalahgunakan).<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">3) Buat file <code>.htpasswd<\/code> (username + hashed password)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Anda dapat membuat file <code>.htpasswd<\/code> via SSH (jika tersedia) atau membuat file secara manual di File Manager menggunakan hash yang dihasilkan.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">Opsi A \u2014 (Paling direkomendasikan) Buat via SSH<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Jika Anda punya akses SSH ke server:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># buat file baru dan simpan user 'admin' dengan password 'admin1234'\nhtpasswd -cb \/home\/u1234567\/.htpasswd admin admin1234\n# -c : create file; -b : menggunakan password di commandline (hati-hati history)\n# atau tanpa -b agar diminta input password interactif:\nhtpasswd -c \/home\/u1234567\/.htpasswd admin\n<\/code><\/pre>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Setelah perintah ini, file <code>\/home\/u1234567\/.htpasswd<\/code> berisi <code>username:hash<\/code>.<\/p>\n<\/blockquote>\n\n\n\n<h3 class=\"wp-block-heading\">Opsi B \u2014 (Tanpa SSH) Buat file <code>.htpasswd<\/code> manual<\/h3>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Jika tidak ada SSH, Anda bisa membuat <code>.htpasswd<\/code> di local lalu upload ke <code>\/home\/&lt;USER&gt;\/.htpasswd<\/code>.<\/li>\n\n\n\n<li>Format baris: <code>username:hashedpassword<\/code><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Contoh (sudah berisi hash untuk password <code>admin1234<\/code>):<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>admin:$apr1$L1sz5qIZ$4omYoA9dM83O2cru5LPae0\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">Buat file <code>.htpasswd<\/code> berisi baris di atas dan simpan di lokasi aman (di luar <code>public_html<\/code>), misal <code>\/home\/&lt;USER&gt;\/.htpasswd<\/code>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Perizinan file:<\/strong> set <code>0644<\/code> (<code>rw-r--r--<\/code>) agar server bisa membaca:<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>chmod 644 \/home\/u1234567\/.htpasswd\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Opsi C \u2014 Gunakan generator online<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Jika mau generate hash online, gunakan generator tepercaya (hati-hati memasukkan password sensitif ke layanan pihak ketiga). Contoh generator yang sering dipakai:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.web2generators.com\/apache\/htpasswd-generator\" target=\"_blank\" rel=\"noopener\">https:\/\/www.web2generators.com\/apache\/htpasswd-generator<\/a><\/li>\n\n\n\n<li><a href=\"https:\/\/www.htaccesstools.com\/htpasswd-generator\/\" target=\"_blank\" rel=\"noopener\">https:\/\/www.htaccesstools.com\/htpasswd-generator\/<\/a><\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">(copy hasil <code>username:hash<\/code> ke file <code>.htpasswd<\/code>)<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">4) Edit <code>.htaccess<\/code> pada root domain untuk mengaktifkan Basic Auth<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">File <code>.htaccess<\/code> berada di:<br><code>\/home\/&lt;USER>\/domains\/contoh.com\/public_html\/.htaccess<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Tambahkan blok ini PADA ATAS semua isi <code>.htaccess<\/code> yang lain (sebelum <code># BEGIN WordPress<\/code>):<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Basic Auth - temporary site protection (put this at very top)\nAuthType Basic\nAuthName \"Restricted Area\"\nAuthUserFile \/home\/u1234567\/.htpasswd\nRequire valid-user\n<\/code><\/pre>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Ganti <code>\/home\/u1234567\/.htpasswd<\/code> sesuai path absolut hasil dari langkah 2.<\/p>\n<\/blockquote>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Contoh .htaccess lengkap (WordPress):<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code># Basic Auth - temporary\nAuthType Basic\nAuthName \"Restricted Area\"\nAuthUserFile \/home\/u1234567\/.htpasswd\nRequire valid-user\n\n# BEGIN WordPress\n&lt;IfModule mod_rewrite.c&gt;\nRewriteEngine On\nRewriteBase \/\nRewriteRule ^index\\.php$ - &#91;L]\n...\n&lt;\/IfModule&gt;\n# END WordPress\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Catatan penting:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Blok harus di atas aturan WordPress agar login muncul sebelum WP diproses.<\/li>\n\n\n\n<li>Jika server Anda murni <strong>Nginx<\/strong>, <code>.htaccess<\/code> tidak berlaku \u2014 gunakan panel Hostinger Password Protect atau konfigurasi Nginx di level server.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">5) Verifikasi<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Buka <code><code>https:\/\/contoh.com\/<\/code><\/code> di browser incognito \u2192 seharusnya muncul dialog username\/password.\n<ul class=\"wp-block-list\">\n<li>Username: <code>admin<\/code><\/li>\n\n\n\n<li>Password: <code>admin1234<\/code><\/li>\n<\/ul>\n<\/li>\n\n\n\n<li>Buka <code>https:\/\/contoh.com\/robots.txt<\/code> \u2192 pastikan berisi <code>Disallow: \/<\/code>.<\/li>\n\n\n\n<li>Hapus <code>phpinfo.php<\/code> (sangat penting).<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">6) Opsi tambahan &amp; troubleshooting<\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Jika ingin mengizinkan IP tertentu (mis. IP tim dev)<\/strong>, gunakan kombinasi: <code>&lt;RequireAny&gt; Require ip 203.0.113.45 Require valid-user &lt;\/RequireAny&gt;<\/code> Ganti <code>203.0.113.45<\/code> dengan IP Anda.<\/li>\n\n\n\n<li><strong>Jika dialog login muncul tapi password ditolak<\/strong>:\n<ul class=\"wp-block-list\">\n<li>Pastikan <code>AuthUserFile<\/code> menunjuk path absolut yang benar.<\/li>\n\n\n\n<li>Pastikan format <code>.htpasswd<\/code> <code>username:hash<\/code>, bukan <code>username:plaintext<\/code>.<\/li>\n\n\n\n<li>Pastikan permission file 644.<\/li>\n\n\n\n<li>Pastikan server mendukung <code>.htaccess<\/code> (Apache \/ LiteSpeed). Jika Nginx, gunakan panel Hostinger.<\/li>\n<\/ul>\n<\/li>\n\n\n\n<li><strong>Jika terjadi 500 error setelah edit <code>.htaccess<\/code><\/strong> \u2192 rollback perubahan, periksa error_log (atau hubungi support hosting). Biasanya sintaks <code>.htaccess<\/code> yang salah penyebabnya.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\">7) Setelah Launch \u2014 membalik proteksi<\/h2>\n\n\n\n<ol class=\"wp-block-list\">\n<li>Hapus atau komentari blok Basic Auth di <code>.htaccess<\/code>.<\/li>\n\n\n\n<li>Update <code>robots.txt<\/code> agar mengizinkan indexing (atau hapus <code>Disallow<\/code>).<\/li>\n\n\n\n<li>Non-aktifkan noindex di plugin SEO jika sebelumnya Anda aktifkan.<\/li>\n\n\n\n<li>Submit sitemap ke Google Search Console bila perlu.<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\">Contoh file &amp; perintah siap pakai (copy\u2013paste)<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>robots.txt<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>User-agent: *\nDisallow: \/\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>phpinfo.php (temporary)<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\necho \"SCRIPT_FILENAME: \" . __FILE__ . \"\\n\\n\";\nphpinfo();\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>.htpasswd (contoh baris, sudah hash password admin1234)<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>admin:$apr1$L1sz5qIZ$4omYoA9dM83O2cru5LPae0\n<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Blok .htaccess (letakkan paling atas)<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AuthType Basic\nAuthName \"Restricted Area\"\nAuthUserFile \/home\/u1234567\/.htpasswd\nRequire valid-user\n<\/code><\/pre>\n\n\n\n<h3 class=\"wp-block-heading\">Keamanan &amp; privasi<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Jangan biarkan <code>phpinfo.php<\/code> online lebih lama dari perlu. Hapus segera.<\/li>\n\n\n\n<li>Hindari memasukkan password sensitif ke generator online jika Anda khawatir \u2014 lebih baik generate hash di server via <code>htpasswd<\/code> or <code>openssl passwd -apr1<\/code>.<\/li>\n\n\n\n<li>Simpan file <code>.htpasswd<\/code> di luar <code>public_html<\/code> untuk mencegah akses langsung.<\/li>\n<\/ul>","protected":false},"excerpt":{"rendered":"<p>Sebelum meluncurkan situs ke publik, praktik terbaik adalah menutup akses publik dan crawler. Di bawah ini langkah urutannya \u2014 mudah diikuti, lengkap dengan file yang bisa Anda copy\u2013paste. 1) Buat robots.txt untuk memblokir semua crawler Letakkan robots.txt di root domain (contoh path di Hostinger):\/home\/&lt;USER&gt;\/domains\/contoh.com\/public_html\/robots.txt Isi file (robots.txt): Langkah (File Manager): Verifikasi: buka https:\/\/contoh.com\/robots.txt \u2014 harus [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":2418,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[75],"tags":[],"class_list":["post-2415","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tutorial"],"acf":[],"_links":{"self":[{"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/posts\/2415","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/comments?post=2415"}],"version-history":[{"count":4,"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/posts\/2415\/revisions"}],"predecessor-version":[{"id":2421,"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/posts\/2415\/revisions\/2421"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/media\/2418"}],"wp:attachment":[{"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/media?parent=2415"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/categories?post=2415"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mahfudly.com\/en\/wp-json\/wp\/v2\/tags?post=2415"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}