Password protecting a directory in cPanel

To password protect a directory in cPanel, open cPanel, go to the Files section, click Directory Privacy, browse to the folder you want to lock, enable password protection, then create at least one authorized user. Visitors will then be prompted for a username and password before the folder loads. This uses standard HTTP Basic Authentication, which the web server enforces before any file in the folder is served.

When to use Directory Privacy

Directory Privacy is ideal for staging areas, admin folders, private downloads, or any part of your site you do not want public or indexed by search engines. Because the server challenges every request, protected files never render for unauthenticated visitors and are effectively hidden from crawlers. If you only need to keep a folder out of search results but still allow public access, this is not the right tool; use a robots directive or noindex instead.

Step-by-step: protect a folder

1. Log in to cPanel and, in the Files section, click Directory Privacy.
2. Use the file tree to navigate into public_html and locate the folder you want to secure. Click the folder name to open it, or click the Edit button next to it.
3. Check the box labeled Password protect this directory.
4. In the field for the protected resource name, type a short label such as Members Area. This text appears in the browser login prompt.
5. Click Save. cPanel confirms the directory is now protected.
6. Return to the same screen and scroll to Create User. Enter a username and a strong password, confirm the password, then click Save.

The protection takes effect immediately. You can add several users for the same folder, and you can revoke access later by returning to Create User, selecting a name, and deleting it.

How it works behind the scenes

When you enable protection, cPanel writes an .htaccess file in the target folder along with an .htpasswd file that stores each username and a hashed password. A typical .htaccess block looks like this:

AuthType Basic
AuthName "Members Area"
AuthUserFile "/home/username/.htpasswds/public_html/members/passwd"
require valid-user

On LiteSpeed, which powers ASEOHosting servers, these Apache-style directives are read natively, so the same rules work without extra configuration. You generally should not edit these files by hand; let the Directory Privacy interface manage them to avoid syntax errors that could return a 500 error for the whole folder.

Testing and troubleshooting

Open the protected URL in a private or incognito window. You should see a browser login dialog. Enter one of the users you created; if the credentials are accepted, the folder loads normally. Keep these points in mind:

• Always serve the login over HTTPS so credentials are not sent in clear text. If you have not secured the domain yet, add a certificate first from our SSL certificates page.
• If you get an Internal Server Error after saving, a stray edit to .htaccess is the usual cause. Remove protection and re-add it to let cPanel rewrite the file cleanly.
• Basic Authentication credentials are cached by the browser for the session. To retest as a fresh visitor, close all windows or use a new private session.

Security notes

Use a long, unique password for each user and change it if a team member leaves. Directory Privacy protects the contents of a folder and its subfolders, but it does not encrypt the files at rest, so treat it as an access gate rather than a vault. For a public site, do not protect folders that must stay open, such as your WordPress uploads directory, or images and stylesheets will fail to load for visitors. For deeper server hardening guidance, review the official cPanel documentation.

Password protection is one small part of running a clean, well isolated site on a dedicated Class C IP. For more setup walkthroughs, see our cPanel and technical guides, or reach out through contact us if you would like help locking down a specific folder.