This section examines the topic of user authentication. Third-party products and modules aside, Apache supports two methods of restricting user access to directories and/or files: Basic authentication and digest authentication. The key difference between these two methods of authentication lies in how passwords are transmitted: basic sends clear text passwords; digest encrypts passwords using a hash function. Keep in mind that with either method, once a user is authenticated all subsequent transactions between the client and server are sent in clear text. If fully encrypted transactions are what you're after, Secure Sockets Layer (SSL) is the route to follow. Installing and configuring SSL is a relatively complex topic and beyond the scope of this tutorial; see Further resources for a link to the apache-ssl.org Web site, which contains full details on implementing SSL under Apache.