Password-protecting a directory

Sometimes you want a folder on your website to require a username and password before anyone can see it — staging sites, internal docs, work-in-progress pages. HTTP Basic Authentication does this, and you set it up in two clicks.

Set it up

In cPanel (we haven't built a portal-native version yet):

1. Open cPanel from your hosting service.
2. Find Directory Privacy under Files.
3. Pick the folder you want to protect.
4. Tick Password protect this directory.
5. Set a label for the prompt ("Staging Site," "Internal Docs," etc.).
6. Save.

Then add at least one user:

1. Below the toggle, fill in Username and Password.
2. Click Save to create the user.

The directory is protected immediately. Anyone visiting it sees a browser-level login prompt.

How visitors see it

When someone hits a protected URL, their browser shows a built-in login dialog asking for username and password. They enter the credentials you set up, and the page loads. The browser remembers credentials for the session, so they don't get prompted on every page within the protected folder.

Multiple users

You can add multiple users, each with their own password. Useful when:

• Different team members need access.
• You're handing out a temporary password to a single client (revoke it later).
• You want to track who used which credentials (each user has its own audit trail in access logs).

Removing protection

Same Directory Privacy tile:

1. Open the protected directory.
2. Untick Password protect this directory.
3. Save.

The folder is public again. To remove specific users without disabling protection entirely, delete the user from the user list.

Common scenarios

• Staging site at staging.yourdomain.com — protect the staging document root so only your team and clients can preview.
• Coming-soon page during a redesign — protect the document root so only stakeholders see in-progress work.
• Members area on a site — for a more dynamic version, use WordPress with a membership plugin instead of basic auth.
• Sensitive files within an otherwise public site — protect /admin/ or /internal/ while leaving the rest open.

What it doesn't do

• Not encryption — basic auth is just credentials. The data on the server isn't encrypted; the network connection (if HTTPS) is.
• Not session-based — there's no "log out" button. Closing the browser ends the session; otherwise it persists.
• Not granular — anyone with valid credentials sees everything in the protected folder. Per-user permissions need application-level auth.
• Not great UX — the browser-native prompt is functional but ugly. For customer-facing protection, build proper login into your application.

Combined with HTTPS

Always use basic auth over HTTPS, never plain HTTP. Without TLS, credentials are sent base64-encoded (not encrypted) in every request — anyone on the network can read them. We auto-issue HTTPS for every domain, so this should be the default.

.htaccess reference

If you're comfortable editing .htaccess directly, basic auth uses:

AuthType Basic
AuthName "Protected Area"
AuthUserFile /home/your-username/.htpasswds/path/to/dir/passwd
require valid-user

The cPanel tool generates this .htaccess rule plus the .htpasswd file containing hashed passwords. Editing .htaccess manually works too, but the tool is easier.