Also, consider the case of adding new users into your acl_users folder: did you just send a username and password combination over the network in plaintext while you were creating that user? Was there a /manage anywhere in the transaction for Apache to intercept and rewrite?

You're right, that's what I forgot. _________________________________________________________________ Get your FREE download of MSN Explorer at http://explorer.msn.com/intl.asp