I found the problem, but can't explain it. In my original site-specific .conf file I had a directory block giving access to a directory that does not exist. It was a holdover from the old system that was not duplicated/replicated on the new one. The odd thing is that Apache didn't complain about the directory itself not existing. What it did, though, was to let anyone in to the directory block immediately preceding it, which *is* password-protected. When I removed the directory block pointing to the non-existent directory, the password--protected one displayed the normal username-and-password access dialog as it should. Very odd. --------------------------------------------------------------------- To unsubscribe, e-mail: users-unsubscribe@xxxxxxxxxxxxxxxx For additional commands, e-mail: users-help@xxxxxxxxxxxxxxxx