How to fix a 401 Unauthorized error

A 401 Unauthorized error means the server needs you to authenticate and either got no credentials or rejected the ones sent. It is different from a 403 Forbidden error: with a 401 you can get in once you provide the right login, while a 403 blocks you regardless. Here is how to track down and fix a 401 error.

Before you start

• The URL that returns 401 and whether a login prompt appears.
• Access to cPanel if you manage the site.

Common causes of a 401 Unauthorized error

• Password-protected directory – cPanel's Directory Privacy (HTTP basic auth) is enabled on the folder.
• Wrong or cached credentials – the browser keeps sending an old username or password.
• A broken .htpasswd path in .htaccess, so no password can ever match.
• Expired or missing API token when calling a REST API.
• A security plugin protecting wp-admin or wp-login.php with an extra login.

How to fix a 401 error

1. Re-enter the credentials carefully. Basic auth usernames are case-sensitive.
2. Clear cached logins. Close all browser windows, or open a private window, so the browser forgets the old credentials.
3. Check Directory Privacy. Go to cPanel → Files → Directory Privacy, open the folder and see whether Password protect this directory is ticked. Reset the user's password there, or untick it if protection is no longer wanted.
4. Inspect .htaccess. In File Manager (enable hidden files) look for AuthType Basic and AuthUserFile. The AuthUserFile path must point to an existing .htpasswd file. See .htaccess errors troubleshooting.
5. Look at parent folders. Protection set on public_html applies to every subfolder, which surprises people who protected a folder higher up.
6. For APIs, regenerate the token and confirm the client sends the Authorization header. Some setups strip that header before PHP sees it; adding CGIPassAuth On in .htaccess can pass it through.

What to check afterwards

Load the URL in a private window. You should see either the page or a single login prompt that accepts your details. Check cPanel → Metrics → Errors for messages such as user not found or password mismatch, which tell you which side is wrong.

FAQ

What is the difference between 401 and 403?

401 means "log in first"; 403 means "you are not allowed, even logged in". See fixing 403 Forbidden in cPanel.

Why does the login prompt keep coming back?

The password does not match the .htpasswd entry, or AuthUserFile points to the wrong file. Reset the password in Directory Privacy.

Can a 401 error affect Google?

Yes. Googlebot cannot log in, so protected pages are not indexed. Only protect pages you want kept private.

Next steps

• HTTP error codes explained
• Read cPanel error logs
• Contact support if you cannot find where the protection is set.