cPanel Security

Locking Down a Folder: Password-Protecting a Directory in cPanel

Put a login prompt in front of any folder — a staging site, an admin panel, or client files — using cPanel's Directory Privacy tool.

cPanel

Built-in tool

HTTP Auth

Protection type

Instant

Takes effect

24/7

Human support

In short

To password protect a directory in cPanel, open File Manager or the Directory Privacy icon, navigate to the folder, and check "Password protect this directory." Give the protection a name, then create at least one username and password under the same screen and save — visitors now see an HTTP login prompt before the folder loads.

Behind the scenes, cPanel writes an .htpasswd file (usually stored outside the public web root) and an AuthUserFile directive into that folder's .htaccess, which is what actually enforces the login.

A staging copy of a site before launch, a folder of client proofs, internal documentation, or an admin panel you'd rather not expose to search engines are all good candidates for a password gate that doesn't require building a full login system. Directory Privacy adds exactly that: a browser-level username and password prompt for one specific folder.

Because it works through HTTP basic authentication rather than your CMS, it protects the folder even if the application inside it has a bug or hasn't loaded yet — the web server itself asks for credentials before serving a single file.

Where Directory Privacy Lives in cPanel

Directory Privacy is listed under the Files section of cPanel, or accessible by right-clicking any folder inside File Manager and choosing "Password Protect." Both paths lead to the same screen: a checkbox to enable protection, a name field for the prompt visitors see, and a place to add usernames and passwords.

You can protect any folder in the account this way — a subdirectory of your main domain, an addon domain's folder, or a folder under a subdomain — the setting is per-directory, so sibling folders stay publicly accessible unless you protect them too.

Adding Users and Passwords to a Protected Folder

After naming the protected area, scroll to "Create User" on the same screen, enter a username and a password (cPanel will rate its strength), and click Save. You can add several separate logins to the same folder — useful when more than one client or team member needs access with their own credentials.

Removing access later is just as simple: delete the user from the list, or uncheck "Password protect this directory" entirely to open the folder back up without deleting any files inside it.

How Basic Auth Works Behind the Scenes (.htpasswd)

When you save Directory Privacy settings, cPanel creates an .htpasswd file containing the encrypted username and password pairs, plus an .htaccess file in the protected folder referencing it with AuthUserFile and AuthType Basic directives. The .htpasswd file itself is typically placed outside the public web root so it can't be downloaded directly.

This is the same mechanism developers set up by hand on servers without a control panel — cPanel just generates and wires up the files for you, so there's no risk of a typo in the .htaccess syntax breaking the whole folder.

Directory Privacy vs Full Login Systems

Directory Privacy is a browser-level gate, not an application login — it's fast to set up but doesn't offer password resets, user roles, or a branded login page. For a handful of trusted people who need temporary or simple access, that's usually enough.

For a customer-facing member area with self-service accounts, a proper login system built into your CMS or app is the better fit. Use Directory Privacy for internal, staging, or short-lived access, and a full auth system when the audience is your actual customers.

How to Password Protect a Directory in cPanel

One Extra Layer Before Launch Day

Password-protecting a directory is a fast way to keep a site invisible to search engines and casual visitors while it's still being built or reviewed. Combined with free auto-renewing SSL, credentials are encrypted in transit even during the review phase, not just after the site goes public.

Because the setting lives in cPanel rather than inside your CMS, it survives theme changes, plugin updates, or even a full site rebuild underneath it — the folder stays locked until you deliberately turn Directory Privacy off.

Protects a folder with an HTTP login prompt, no plugin needed
Add multiple usernames and passwords to the same directory
Credentials are encrypted in transit via free SSL
Setting is independent of your CMS, so it survives site rebuilds

Why Hosting Cheap

What you get

No code editing

cPanel writes the .htaccess and .htpasswd files for you automatically.

Per-folder control

Protect exactly the directory you choose without affecting sibling folders.

Multiple logins supported

Give each client or teammate their own username and password.

Works before launch

Keep a staging or pre-launch site hidden from search engines and visitors.

Reversible in one click

Uncheck the protection to reopen the folder without touching any files.

CMS-independent

Enforced by the web server, so it protects the folder even if the app inside has issues.

How It Works

Get set up in a few steps

Open Directory Privacy

Find it under Files in cPanel, or right-click a folder in File Manager.

Name the protected area and enable it

Check the password-protect box and give the prompt a label.

Create a username and password

Add one or more logins, save, and test the folder in a private browser window.

Included

Everything you need, on every plan

Confirm you're protecting the correct folder before saving
Give the protection a clear name so visitors know what they're logging into
Use a strong, unique password for each user you create
Test the login in a private/incognito window after setup
Remember .htpasswd sits outside the web root and shouldn't be moved
Remove protection fully once a staging site goes live, if no longer needed
Keep a record of which client or teammate has which login
Pair with SSL so credentials aren't sent in plain text

FAQ

Frequently asked questions

Does password protecting a directory in cPanel affect my whole website?

No. Directory Privacy is applied per folder, so only the directory you protect (and its subfolders, if included) prompts for a login. The rest of your site stays publicly accessible exactly as before.

Can I add more than one username and password to the same folder?

Yes. The Directory Privacy screen lets you create as many user accounts as you need for a single protected folder, each with its own username and password.

Where does cPanel store the password file?

cPanel generates an .htpasswd file, typically stored outside the public web root, along with an .htaccess file in the protected folder that references it — this keeps the credentials file from being downloaded directly.

Will this work if my site uses HTTPS?

Yes, and it's recommended. With free auto-renewing SSL in place, the username and password exchanged during the login prompt are encrypted in transit rather than sent as plain text.

How do I remove password protection later?

Return to Directory Privacy, uncheck "Password protect this directory," and save. The folder becomes publicly accessible again immediately, with no files deleted or altered.

Is Directory Privacy the same as a WordPress login?

No. Directory Privacy is an HTTP basic-auth prompt enforced by the web server itself, separate from any CMS login. It's faster to set up for simple access needs but doesn't offer features like password resets or user roles.

Host Sites With Directory-Level Security Included

Directory Privacy, free auto-renewing SSL, and daily backups all come standard with cPanel hosting.

Get Started