Um, that should be Basic with a capital B, apparently. Zounds! header( 'WWW-Authenticate: Basic realm="Members Only" ' ); header( 'HTTP/1.0 401 Unauthorized' ); Guess I should RTFM.