Directory Privacy puts a username and password on a folder of your website. Anyone who visits it sees a login prompt in their browser. It's handy for staging sites, private downloads, or as an extra lock on an admin area.
Protect a directory
- Log in to cPanel and open Files › Directory Privacy.
- Browse to the folder you want to protect by clicking folder names to open them. Your website's files are in
public_html. - Click Edit next to the folder.
- Tick Password protect this directory and enter a name for it. The name appears in the login prompt, for example "Staging site". Click Save, then Go Back.
- Under Create User, enter a username and password (or use Password Generator) and click Save.
Visit the folder, for example https://example.co.uk/staging/, and you should be asked to log in. The protection covers everything inside the folder, including subfolders.
Manage users or remove the protection
- To give someone else access, create another user on the same page. To remove someone, select them under Authorized Users and click Delete User.
- To remove the protection, open the folder's Edit page again, untick Password protect this directory and click Save.
Good to know
- Use it over HTTPS. The browser sends the username and password with every request, so make sure the site has a certificate and HTTPS is forced.
- Be careful protecting WordPress's
wp-adminfolder. Some themes and plugins load files from it on the public site, which then stops working for visitors. Restricting it by IP address is often a better choice. See blocking or allowing IP addresses. - Entering the wrong password repeatedly counts as failed logins and can get your IP blocked. If that happens, see how to get your IP unblocked.
