You can password-protect any directory on your website so that visitors must enter a username and password to access it. This is useful for staging areas, private file downloads, admin sections, or client portals. cPanel has a built-in tool that makes it easy, no manual .htaccess editing required.
cPanel > Directory Privacy
- cPanel > Directory Privacy > select the folder
- Check "Password protect this directory" and name it
- Create a user with a username and password
- Visitors now see a login prompt when accessing that folder
01. Password Protect via cPanel
- Log into cPanel > click Directory Privacy (in the Files section)
- Navigate to the directory you want to protect and click its name
- Check "Password protect this directory"
- Enter a name for the protected directory (this appears in the login prompt visitors see)
- Click Save
- Create an authorized user - enter a username and password, then click "Add or modify the authorized user"
You can add multiple users if several people need access. Each gets their own username and password.
Password protection works on any directory, including public_html itself (protects your entire site), subdirectories, or addon domain directories. The login prompt appears before any content is served, so even images and CSS in the protected directory are hidden.
02. Manual .htaccess Method
If you prefer manual control, create two files in the directory you want to protect:
.htaccess
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/yourusername/.htpasswds/public_html/protected/passwd
Require valid-user.htpasswd
Generate the password hash using cPanel > Terminal:
htpasswd -c /home/yourusername/.htpasswds/public_html/protected/passwd usernameThe AuthUserFile path must be the full server path to the password file, not a relative path. Place the password file outside of public_html if possible so it can't be downloaded by visitors.
For more .htaccess techniques, see our Complete .htaccess Guide.
03. Removing Password Protection
To remove protection, go back to cPanel > Directory Privacy, navigate to the folder, and uncheck "Password protect this directory." Click Save. The directory is immediately public again.
If you used the manual method, delete the AuthType, AuthName, AuthUserFile, and Require lines from the .htaccess file.
Need Help With Access Control?
If you need more advanced access control (IP-based restrictions, single sign-on, etc.), open a ticket and describe your requirements.
Open a Support TicketFrequently Asked Questions
How do I password-protect a directory in cPanel?
Use the Directory Privacy tool in cPanel, choose the folder, enable protection, and create a username and password. cPanel writes the necessary .htaccess and password files for you, so no manual editing is needed.
Can I password-protect a folder without cPanel?
Yes. You can create an .htaccess file with AuthType and require-valid-user directives plus an .htpasswd file of credentials. The cPanel Directory Privacy tool does exactly this for you, which is simpler and less error-prone.
What is directory password protection useful for?
It is ideal for staging areas, private downloads, admin sections, and client portals, where you want a login prompt before anyone can view the folder. It adds an access gate on top of whatever the application itself does.
How do I remove password protection from a directory?
In the cPanel Directory Privacy tool, open the folder and disable protection, then remove any users you added. If you set it up manually, delete or edit the relevant .htaccess and .htpasswd entries.
Quick Recap
- cPanel > Directory Privacy - easiest method, no code needed
- Select directory, enable protection, create user - three steps
- Multiple users supported - each with their own credentials
- Works on any directory - including your entire site
- Remove by unchecking - in Directory Privacy settings
Last updated November 2026 · Browse all General articles
