Password-protect a directory in DirectAdmin

Password-protecting a directory adds a browser login prompt (HTTP basic authentication) in front of a folder. It is perfect for staging copies, client previews, private downloads or an extra lock on an admin area. DirectAdmin creates the needed .htaccess and .htpasswd files for you.

Before you start

• Your DirectAdmin login and the domain selected at the top.
• An SSL certificate on the domain. Basic authentication sends the password with each request, so only use it over HTTPS. See Let's Encrypt in DirectAdmin.

Protect a directory

1. Go to Advanced Features → Password Protected Directories (or open the folder in the File Manager and choose Protect).
2. Click Create Protected Directory or browse to the folder, for example domains/example.com/public_html/staging.
3. Tick Protection Enabled.
4. Enter a Prompt, the text shown in the login box, for example Staging area.
5. Enter a Username and Password for the first user.
6. Click Save.

To protect the whole site, choose public_html itself.

Add or remove users

Open the protected directory again from Password Protected Directories. Enter another user name and password and save to add a user, or tick an existing user and click Delete to remove access. Give each person their own login so you can revoke access individually.

Remove protection

Untick Protection Enabled and save, or delete the entry in the list. The files in the folder are not affected.

Good uses

• Staging sites: stops visitors and search engines from seeing unfinished work.
• Client downloads: one login per client for shared files.
• Admin areas: an extra layer in front of wp-admin or a tool like Adminer.

If you protect wp-admin, allow admin-ajax.php or front-end features may break. Add this to wp-admin/.htaccess:

<Files admin-ajax.php> Require all granted </Files>

Check it works

• Open the URL in a private window; the browser should ask for credentials.
• From a terminal: curl -I https://example.com/staging/ should return 401 Unauthorized.

Troubleshooting

• Prompt keeps reappearing: the password is wrong, or you are entering a DirectAdmin or FTP password instead of the directory user's password.
• No prompt at all: the web server ignores .htaccess (pure Nginx setups) or the protection was set on a different folder.
• 500 Internal Server Error: a conflicting rule already exists in .htaccess. Remove duplicate AuthType blocks.
• Search engines already indexed staging: protection blocks them from now on; request removal in Google Search Console.

Next steps

• Redirects and error pages.
• Secure your DirectAdmin login.
• Use the File Manager.