How do I password-protect a folder?

In cPanel, open Files → Directory Privacy, click Edit next to the folder, tick Password protect this directory, then create a username and password. Anyone who opens that folder in a browser must log in first.

This is useful for a test copy of your site, documents only your board or staff should see, or a new site you aren’t ready to show.

1. Log in to cPanel and open Files → Directory Privacy.
2. Find the folder. Your website is in public_html; click a folder’s name to open it and see the folders inside.
3. Click Edit next to the folder you want to protect.
4. Tick Password protect this directory, type a name for it (visitors see this on the login box) and click Save.
5. Click Go Back. Under Create User, enter a username and a strong password, then click Save. Add one user per person if several people need access.
6. Open the folder’s address in a private browser window to check that it asks for the login.

The protection covers the folder and every folder inside it. To remove it, open the folder in Directory Privacy again, untick the box and click Save. To remove one person, delete their user under Authorized Users.

Tip: Make sure the site uses https before you rely on this, or the password crosses the internet unprotected. See How do I make my site always use HTTPS?

Can I protect my WordPress admin area this way?

Not the whole wp-admin folder: parts of a WordPress site call files inside it, so they would break for visitors. Use strong passwords and two-factor login in WordPress instead, or put a firewall such as Armor Guard in front of the site.

The folder now shows a 401 or 403 error.

A 401 means the login was wrong or cancelled. For a 403, see How do I fix a 403 Forbidden error?

Still stuck? Open a support ticket with the folder you are trying to protect, or message us on WhatsApp.

Updated 6 November 2026. Something here out of date? Tell us.