At these URLs https://httpd.apache.org/docs/2.4/mod/mod_auth_form.html#inline https://httpd.apache.org/docs/trunk/mod/mod_auth_form.html#inline they give the following example: (Basic inline example) AuthFormProvider file ErrorDocument 401 "/login.shtml" AuthUserFile "conf/passwd" AuthType form AuthName /admin AuthFormLoginRequiredLocation "http://example.com/login.html" <<<< NOTE Session On SessionCookieName session path=/ Based on testing, the AuthFormLoginRequiredLocation line needs to be removed. That is also consistent with the previous description which says: "If a non-authenticated user attempts to access a page protected by mod_auth_form <<<that isn't configured with a AuthFormLoginRequiredLocation directive>>>, a HTTP_UNAUTHORIZED status code is returned to the browser indicating to the user that they are not authorized to view the page." (<<< emphasis mine >>>)