You can password-protect any directory on your website so that visitors must enter a username and password to access it. This is useful for staging areas, private file downloads, admin sections, or client portals. cPanel has a built-in tool that makes it easy, no manual .htaccess editing required.
cPanel > Directory Privacy
- ✓ cPanel > Directory Privacy > select the folder
- ✓ Check "Password protect this directory" and name it
- ✓ Create a user with a username and password
- ✓ Visitors now see a login prompt when accessing that folder
01. Password Protect via cPanel
- Log into cPanel > click Directory Privacy (in the Files section)
- Navigate to the directory you want to protect and click its name
- Check "Password protect this directory"
- Enter a name for the protected directory (this appears in the login prompt visitors see)
- Click Save
- Create an authorized user - enter a username and password, then click "Add or modify the authorized user"
You can add multiple users if several people need access. Each gets their own username and password.
Password protection works on any directory, including public_html itself (protects your entire site), subdirectories, or addon domain directories. The login prompt appears before any content is served, so even images and CSS in the protected directory are hidden.
02. Manual .htaccess Method
If you prefer manual control, create two files in the directory you want to protect:
.htaccess
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/yourusername/.htpasswds/public_html/protected/passwd
Require valid-user.htpasswd
Generate the password hash using cPanel > Terminal:
htpasswd -c /home/yourusername/.htpasswds/public_html/protected/passwd usernameThe AuthUserFile path must be the full server path to the password file, not a relative path. Place the password file outside of public_html if possible so it can't be downloaded by visitors.
For more .htaccess techniques, see our Complete .htaccess Guide.
03. Removing Password Protection
To remove protection, go back to cPanel > Directory Privacy, navigate to the folder, and uncheck "Password protect this directory." Click Save. The directory is immediately public again.
If you used the manual method, delete the AuthType, AuthName, AuthUserFile, and Require lines from the .htaccess file.
Need Help With Access Control?
If you need more advanced access control (IP-based restrictions, single sign-on, etc.), open a ticket and describe your requirements.
Open a Support TicketQuick Recap
- cPanel > Directory Privacy - easiest method, no code needed
- Select directory, enable protection, create user - three steps
- Multiple users supported - each with their own credentials
- Works on any directory - including your entire site
- Remove by unchecking - in Directory Privacy settings
Last updated March 2026 · Browse all General articles
