Password-Protect a Website Directory in cPanel

cPanel Directory Privacy adds a separate web-server login to a selected directory. It can protect a staging area or restricted download over HTTPS, but it is not a replacement for application permissions or private storage outside the public document root.

Enable protection and create an authorized user

1. Sign in to the trusted cPanel account and open Files > Directory Privacy. The host must make this feature available.
2. Locate the exact directory and open its Edit/security settings. Navigation controls differ between cPanel themes; confirm the complete path rather than relying on an old folder-icon screenshot.
3. Select Password protect this directory, enter a descriptive label and save. The label does not rename the actual folder.
4. Return to the directory’s configuration and create a separate authorized username and long unique password. Enabling the checkbox alone does not create a user.

Verify the actual protected resources

Use a fresh private browser session to request both the directory and a known file inside it over HTTPS. Confirm an unauthenticated request is challenged, an authorized user succeeds, and child directories have the intended inherited protection. Inspect actual response status if an application error page obscures the result; a browser prompt alone is not complete verification.

Directory Privacy governs website requests, not local filesystem, FTP, SFTP or Web Disk access. A reverse proxy, alternate hostname, application route or another web server may expose a different path. Test those applicable routes instead of claiming all access is secured.

If rewrites or error pages interfere

Back up the relevant configuration and investigate authentication, routing and custom 401 error handling together. The old blanket RewriteEngine Off advice is withdrawn: it can break application routing and does not diagnose every authentication problem. Ask the host to review the affected directory’s rules rather than replacing the site’s entire .htaccess file.

Remove access deliberately

To revoke one user, remove that authorized user. To remove the directory’s web password gate, deselect its protection setting and save. Other access controls can still apply; removing this gate does not necessarily make every file public. Review the public response before exposing previously private material.

Reference: cPanel Directory Privacy.

Reviewed October 15, 2026. Documentation review; no directory protection, credential or customer server rule was changed.