Support

He he, that's actually a limitation of the UNIX crypt() function. Let's backtrack a little.

In order to enable the password protection, Admin Tools has to create a .htaccess file enabling Apache's password protection and a .htpasswd file containing the username and password. Apache understands the password in one of the following formats: plain text, hashed with crypt() (unless it's a Windows server), hashed with a platform-specific hash algorithm. We must use one of them.

The plain text method is insecure and is only used as a last resort and on Windows systems.

The platform-specific hash algorithm is SHA (which is not widely supported by most live servers, unfortunately) or a very Apache-specific MD5-based algorithm which is too slow and very difficult to implement in PHP. Bummer. If we want to use it we have to call a system-wide binary called "htpasswd". The problem is that we don't know if this binary exists, where it's stored, if we can use shell_exec() in PHP to run it or even if it can write to our .htpasswd file. This makes using it out of the question.

And this leaves us with encrypting the password with the crypt() function. It has a drawback: it will only take into account the first 8 characters of the password. And that's why everything past the 8th character is ignored.