És imprescindible combinar l'ús amb HTTPS. Vegeu:
Wireshark#Pr.C3.A0ctica_captura_de_contrasenyes
Consulteu Apache#Autenticaci.C3.B3_B.C3.A0sica.htpasswd
TODO
<?php if (!isset($_SERVER['PHP_AUTH_USER'])) { header('WWW-Authenticate: Basic realm="My Realm"'); header('HTTP/1.0 401 Unauthorized'); echo 'Text to send if user hits Cancel button'; exit; } else { echo "<p>Hello {$_SERVER['PHP_AUTH_USER']}.</p>"; echo "<p>You entered {$_SERVER['PHP_AUTH_PW']} as your password.</p>"; } ?>