Password-protect a folder on your website (Directory Privacy)

Directory Privacy adds a username and password prompt to a folder on your website. Anyone visiting that folder, or anything inside it, has to log in first. It's useful for a staging or test site, a private downloads area, a client preview, or an extra layer of protection on an admin area.

Protect a folder

1. Log in to cPanel from your service page under Services → My Services (https://www.hooplahosting.co.nz/client/clientarea.php?action=services).
2. Open Directory Privacy (type it in the cPanel search bar).
3. Browse to the folder you want to protect by clicking the folder names, for example public_html and then staging. Click Edit next to it.
4. Tick Password protect this directory.
5. Enter a name in Enter a name for the protected directory, for example "Staging site". Visitors see this in the login prompt.
6. Click Save, then Go Back.

Add a user who can log in

The folder is now locked, but nobody can get in until you create a user.

1. On the same page, under Create User, enter a username.
2. Enter a password, or click Password Generator to create a strong one.
3. Click Save.

You can add as many users as you need, for example one for each person who needs access. To remove someone's access, select their name under Authorised Users and click Delete User.

These usernames and passwords are separate from your cPanel, email and WordPress logins. Share them only with the people who need them.

Test it

Open the folder's address in a private or incognito browser window, for example https://yourdomain.co.nz/staging/. You should see a login prompt. Enter the username and password you created.

Protecting your whole website

To lock an entire site, for example while it's being built, protect its document root folder (public_html for your main domain, or the addon domain's folder). Remember to remove the protection when the site goes live, or visitors and search engines won't be able to see it.

Protecting the WordPress admin area

You can add a password to the wp-admin folder for extra security, but it needs one extra step. Some parts of WordPress, and many plugins, load a file in wp-admin called admin-ajax.php on the public side of your site. If it's blocked, visitors will get password prompts and features such as forms or "load more" buttons can stop working.

After protecting wp-admin, open File Manager, go to public_html/wp-admin, and edit the .htaccess file there (click Settings and tick Show Hidden Files if you can't see it). Add these lines at the bottom and save:

<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>

For most sites, a strong WordPress password plus two-factor authentication is a simpler way to protect the dashboard.

Remove the password

In Directory Privacy, click Edit next to the folder, untick Password protect this directory and click Save.

Troubleshooting

• The password prompt keeps coming back: check the username and password, which are case sensitive. If you've just changed a password, close the browser fully and try again, as browsers remember these logins.
• "Too many redirects" or a 401 error on the whole site: you may have protected a folder your site relies on. Remove the protection, then protect a more specific folder.
• The folder doesn't ask for a password: make sure you're testing in a private window, and that you protected the right folder. If the site uses Cloudflare, clear its cache.

Need help?

If you get stuck, open a support ticket and we'll help.