Protect a directory with a username and password in cPanel

Directory Privacy adds a username and password prompt to web access to a folder. It can be used for a website under development or a restricted area, but it does not replace the application's users and permissions.

The protection does not apply on its own to FTP, SFTP or processes that access the files locally. Use HTTPS so that the password does not travel over an unencrypted connection.

Enable the protection and create a user

1. Open cPanel > Directory Privacy and find the correct folder. Check the domain's document root if you have several websites.
2. Open its options with Edit or the control your version of the panel shows.
3. Enable Password protect this directory, enter a label to identify it and save. The label does not rename the folder.
4. Go back to the same screen and create an authorised user with a unique password. Enabling the protection does not create that user automatically.
5. Open the URL over HTTPS from a private window and check that it asks for credentials, rejects incorrect ones and accepts the ones you created.

Review the paths that depend on that folder

Subdirectories may inherit the protection. Also test direct links to files and features such as forms, AJAX and webhooks. Protecting the whole document root can stop an automated integration from reaching its endpoint.

If you need an exception, see how to allow a specific file. Do not open up an entire administrative directory to fix a single call.

Change or remove access

Manage authorised users from the same tool and delete those who should no longer have access. To remove the folder's protection, untick the option and save; then check that the result is what you expected.

A password remembered by the browser can hide the login prompt. Use a new private session to check the changes, and keep a way to manage the hosting in case a rule stops the website from opening.