How to password protect a folder

This guide shows how to put a username and password on a folder of your website using Directory Privacy in cPanel.

When to use it

Directory Privacy is handy for keeping a folder away from the public while you work on it. Common examples are a test copy of a site, a folder of files for a client, or an old site you want to keep but not show. Anyone visiting that folder in a browser will be asked to sign in before they see anything.

Protect the folder

1. Log in to cPanel. See how to log in to cPanel.
2. In the Files section, click Directory Privacy.
3. You’ll see the folders in your account. Click a folder name to open it, or click Edit next to the folder you want to protect. Your main website lives in public_html.
4. Tick Password protect this directory.
5. Enter a name for the protected area, for example “Client files”. Visitors see this name in the sign in box.
6. Click Save, then click Go Back.

The wording on your screen may vary slightly with the version of cPanel.

Add a user

The folder is now locked, but nobody can get in until you add at least one user.

1. On the same page, find the Create User section.
2. Enter a username.
3. Enter a password, or click Password Generator to make a strong one. Keep a note of it somewhere safe.
4. Click Save.

Open the folder in a private browser window to check it asks for the username and password. You can add more users in the same way, and remove them from the Authorized Users list on that page.

Remove the password

Open the folder in Directory Privacy again, untick Password protect this directory and click Save.

If it doesn’t work

• The folder opens without asking for a password. Your browser may have remembered an earlier visit. Try a private window or another browser.
• It asks for the password but won’t accept it. Usernames and passwords are case sensitive. Delete the user and create it again with a new password.
• The whole site is locked. You protected public_html or a folder above it. Remove the protection and pick the folder inside instead.
• WordPress stopped working properly. Protecting WordPress folders such as wp-admin can break parts of the site. Use a WordPress security plugin for that instead. See how to secure WordPress.

Good to know

Directory Privacy works through small hidden files called .htaccess and .htpasswd. If you edit or delete the .htaccess file in that folder, the protection may stop working. Protecting a folder also covers every folder inside it.

Still stuck? Open a support ticket and we’ll help.