Password-protect a folder with cPanel Directory Privacy

Directory Privacy (formerly Password Protect Directories) adds a browser login box in front of a folder. Anyone opening a URL inside it must enter a username and password first. It is the quickest way to keep a staging site private, add a second lock to an admin area, or share files with a few people.

Before you start

• Know which folder to protect, for example public_html/staging or public_html/wp-admin.
• This uses HTTP Basic authentication. Always use it over https:// so the password is encrypted.

Protect a folder

1. Open cPanel → Files → Directory Privacy.
2. Browse to the folder: click folder names to open them, then click Edit next to the one you want to protect. Protecting a folder also protects every subfolder.
3. Tick Password protect this directory.
4. Enter a name for the protected area (shown in the login box), e.g. Staging, and click Save.
5. Under Create User, enter a username and a strong password, and click Save.

Open the folder's URL in a private window: the browser should ask for the username and password.

Manage users

On the same page, the Authorized Users list shows who can log in. Select a user and click Delete User to revoke access, or create a user with the same name to change the password. Each protected folder has its own user list.

Protecting the WordPress admin

Protecting wp-admin blocks brute-force bots before they reach WordPress. Two details matter:

• Some plugins and themes call wp-admin/admin-ajax.php from the public site. Allow it by adding this to public_html/wp-admin/.htaccess below the lines cPanel created:
  Copy

  <Files admin-ajax.php>
    Require all granted
  </Files>

• You will enter two logins: the Directory Privacy one, then the normal WordPress login.

Remove protection

Click Edit next to the folder in Directory Privacy, untick Password protect this directory and click Save.

How it works

cPanel adds AuthType Basic lines to the folder's .htaccess and stores encrypted passwords in a file under ~/.htpasswds, outside the web root. If you edit .htaccess by hand, keep those lines intact.

Troubleshooting

• Login box keeps reappearing: the password is wrong, or the site redirects between http and https / www and non-www, each asking again. Use the final address directly.
• 500 error after protecting: an existing .htaccess rule conflicts; see fix 500 errors.
• 404 or a loop on wp-admin: add an ErrorDocument 401 default line at the top of public_html/.htaccess.
• Forgotten the password: create the user again with a new password.

Next steps

• Block attackers by IP
• Create a staging site
• Hotlink and leech protection