Password-protect a directory or website in Plesk

Sometimes a page should not be public: a staging copy, a client preview, or an extra lock in front of an admin area. Plesk's Password-Protected Directories adds HTTP basic authentication, so visitors must enter a user name and password before the web server delivers anything from that folder.

Before you start

• Access to the domain in Plesk.
• An SSL certificate on the domain. Basic authentication sends credentials with every request, so always use HTTPS.

Protect a directory

1. Go to Websites & Domains and, under the domain, click Password-Protected Directories (it may be in the Security or More section).
2. Click Add Protected Directory.
3. Enter the Directory name relative to the document root, for example /staging. Enter / to protect the whole site.
4. Enter a Title of the protected area; browsers show it in the login prompt.
5. Click OK.

Add users

1. Click the protected directory in the list.
2. Click Add User.
3. Enter a user name and strong password and click OK.

Add one user per person so you can remove access individually later. These users are separate from Plesk, FTP and mail accounts.

Protect a WordPress admin area

Protecting /wp-admin adds a second login in front of WordPress and stops most brute-force bots. Two cautions:

• WordPress uses /wp-admin/admin-ajax.php for front-end features. If your theme or forms break, exclude that file using an .htaccess rule inside wp-admin: <Files admin-ajax.php> Require all granted </Files>.
• Consider WP Toolkit's security measures as an alternative; see WP Toolkit.

Good uses and alternatives

• Staging sites: protecting the whole staging domain with / stops search engines and visitors from seeing unfinished work. WP Toolkit staging copies can be protected the same way.
• Download areas: share files with a client using a single user name and password per client.
• Tools such as phpinfo or Adminer: if you must keep them on the server, put them in a protected folder.
• Per-user application logins: basic authentication is not a replacement for real user accounts inside your application, because it has no logout, password reset or roles.

Remove protection

Tick the directory in the list and click Remove Protection. The files stay untouched; only the authentication is removed.

Check it works

• Open the protected URL in a private window – the browser should ask for credentials.
• Run curl -I https://example.com/staging/ and look for 401 Unauthorized.

Troubleshooting

• Login prompt appears again and again: the password is wrong, or the user was created for a different directory. Recreate the user.
• No prompt with nginx-only hosting: if PHP is served by nginx without Apache, Plesk applies protection in the nginx config; make sure you saved after adding users and reload the page without cache.
• Search engines indexed staging: protection blocks crawlers from now on; request removal in Google Search Console.
• 500 error: a conflicting AuthType rule already exists in .htaccess. Remove duplicates.

Next steps

• Harden Plesk with Security Advisor.
• Write redirects and directives.
• Create FTP accounts.