What Directory Privacy does

Directory Privacy, called Password Protect Directories in older cPanel versions, adds HTTP basic authentication to a folder. The browser shows a login box before any file in the folder, or its subfolders, is served. It is useful for:

• A staging or development copy of a site that should not be public or indexed.
• A folder of private downloads for clients.
• An extra login in front of an admin area.

Step 1: choose the folder

1. Log in to cPanel and open Files > Directory Privacy.
2. Browse to the folder. Click a folder name to open it, or click Edit next to it to protect it.

Create the folder first in File Manager if it does not exist yet.

Step 2: turn on protection

1. Tick Password protect this directory.
2. Enter a name for the protected area, for example Staging. Browsers show it in the login box.
3. Click Save.

Step 3: create users

1. In the Create User section, enter a user name.
2. Enter a strong password, or use the password generator.
3. Click Save. Add more users the same way.

These users are separate from your cPanel login and email accounts. They only open this folder.

How it works behind the scenes

cPanel adds lines like these to the folder’s .htaccess file, and stores the users and encrypted passwords in a file under /home/USERNAME/.htpasswds/, outside the public web folder:

AuthType Basic
AuthName "Staging"
AuthUserFile "/home/USERNAME/.htpasswds/public_html/staging/passwd"
require valid-user

Use HTTPS

Basic authentication sends the user name and password with every request. Over plain HTTP they can be read on the network. Make sure the site has a valid SSL certificate and redirects to HTTPS before you rely on Directory Privacy.

Protecting the WordPress admin area

An extra password on wp-admin blocks many automated login attacks. WordPress uses wp-admin/admin-ajax.php for features on the public site, so allow that one file. Add this to wp-admin/.htaccess after cPanel’s lines:

<Files "admin-ajax.php">
    Require all granted
</Files>

For other ways to protect the login page, see our guide to changing the WordPress login URL.

Directory Privacy or another option?

Basic authentication is simple and reliable, but it has no password reset, no logout button and no per-page control, so it is best for small groups of trusted users.

Remove protection

1. Open Directory Privacy and click Edit next to the folder.
2. Untick Password protect this directory and save.
3. Delete users you no longer need in the Authorized Users list.

Troubleshooting