I have an existing ASP.Net 1.1 site that the client now wants me to password-protect. That is, the first time a user goes to a page in the virtual directory it should ask for a password. Typing the wrong password will show an "access denied"-type message, while typing the right password will let the user use the pages as before. One password is good enough for all users, but he wants the ability to change the password.

I investigated form-based authentication, but it seems this would require adding code to every page in the site. I have over 100 pages, many of them .htm pages. I do not want to edit all these pages, nor to change the .htm pages to .aspx. Also, he wants to prevent users from downloading images from the site until they have typed the password.

Is there a simple way to implement this without massive rewriting?
 

make a folder .....put all the files in them....set permissions for the folder in the webconfig.