Password-Protecting a Directory

Directory Privacy lets you put a username-and-password gate in front of any folder on your site. Visitors must sign in before the browser will show anything inside. It's a quick way to lock down a staging area, an admin folder, or private downloads.

What Directory Privacy Does

When you protect a folder, the web server prompts every visitor for credentials before serving any file in it. Only the users you create can get through. Nothing inside the folder is exposed to search engines or the public until someone signs in.

Protecting a Folder

1. Log into cPanel.
2. Go to Files → Directory Privacy.
3. Browse to and click the folder you want to protect.
4. Check Password protect this directory.
5. Enter a label (for example, Staging Area). This text appears in the browser's login prompt.
6. Click Save.

Creating an Authorized User

Protecting the folder is only half the job — you also need at least one login:

1. On the same page, scroll to Create User.
2. Enter a username and a strong password (use Generate for a random one).
3. Click Save.

How It Works Behind the Scenes

Directory Privacy uses two small files that cPanel writes into the protected folder:

• .htaccess — tells Apache to require HTTP authentication for that folder and everything below it.
• .htpasswd — stores the authorized usernames and their hashed passwords.

Together they trigger the standard browser login box (HTTP Basic authentication). You don't need to edit these files by hand; cPanel manages them for you.

Good Use Cases

• A staging area where you preview site changes before they go live.
• An admin folder or internal tool you don't want the public to find.
• Private downloads, drafts, or client deliverables meant for a specific audience.

Removing Protection

1. Return to Files → Directory Privacy and select the folder.
2. Uncheck Password protect this directory.
3. Click Save.