diff --git a/.gitignore b/.gitignore
index 50470c6..1c3f738 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,6 +36,7 @@ ext/ssl
 
 # Nginx; only the default cfg is ignored.
 ext/nginx.conf.d/default.conf
+!ext/nginx.conf.d/.ht*
 
 # Uploaded Assets
 /public/system/*
diff --git a/ext/nginx.conf.d/.htpasswd_staging b/ext/nginx.conf.d/.htpasswd_staging
new file mode 100644
index 0000000..90b1444
--- /dev/null
+++ b/ext/nginx.conf.d/.htpasswd_staging
@@ -0,0 +1 @@
+staging:$apr1$UB3GAUTX$GhkDZSJBKfsWsNOJB15aK/
diff --git a/ext/nginx.conf.d/staging.conf.template b/ext/nginx.conf.d/staging.conf.template
index ea89327..946196c 100644
--- a/ext/nginx.conf.d/staging.conf.template
+++ b/ext/nginx.conf.d/staging.conf.template
@@ -31,13 +31,19 @@ upstream puma {
 
 server {
   listen *:$STAGING_PORT default_server;
-  # SSL disabled for now
+  ## SSL disabled for now
   # listen *:STAGING_PORT_SSL ssl default_server;
-  # domain_agnostic staging
+
+  ## domain_agnostic staging
   # server_name $STAGING_DOMAIN;
   root $APP_PATH_PUBLIC;
   index index.html index.htm index.php;
 
+  # Add basic auth
+  # TODO: add htpassword generation
+  # auth_basic           "Staging Area";
+  # auth_basic_user_file "/etc/nginx/conf.d/.htpasswd_staging";
+
   # ssl_certificate /etc/ssl/certs/ensl_fullchain.pem;
   # ssl_certificate_key /etc/ssl/private/ensl_privkey.pem;