Password-protecting a website folder with cPanel Directory Privacy

Find the correct document root and folder first. Keep a copy of existing .htaccess rules, because application rewrites and access controls share that configuration. Use HTTPS so the browser credentials are protected in transit.

1. Open Directory Privacy in cPanel, navigate to the required directory and choose its Edit action.
2. Select Password protect this directory, enter a descriptive label and save the security setting. The label does not rename the folder.
3. Return to the directory’s configuration and create an authorised username with a strong unique password. Saving protection alone does not create a usable login.
4. Open the protected HTTPS URL in a private browser session. Confirm it requests credentials, then sign in using the directory user you created.
5. Test important application paths and automated checks. Password protection can also block payment callbacks, monitoring or certificate-validation paths beneath that folder.

A fresh unauthenticated session should be challenged, while the authorised user can view the intended content. Check a child directory to understand inherited protection.

If the site loops or returns an error, review conflicting .htaccess rules and restore the recorded configuration if necessary. Remove access for a departed user from the authorised-user list. To make the folder public again, clear the protection checkbox and save rather than deleting application files.

• Blocking an unwanted website visitor with cPanel IP Blocker
• Changing or recovering your cPanel password
• Creating and downloading a full cPanel account backup
• Preventing unintended directory listings in cPanel
• Limiting shared directory credentials with Leech Protection

• cPanel documentation