Walkthrough · Beginner · 5 minutes
How to Password Protect a Folder
Put a login at the server's edge of a folder, ahead of any code your site runs — a hands-on walkthrough in plain words that names the classic mistake before you reach it.
The short answer
One line covers it: put a login at the server's edge of a folder, ahead of any code your site runs — a beginner-level job of roughly 5 minutes.
Below are the precise steps, the classic stumble, and one tip from the support desk. Wherever the platform already does a step for you, the guide says so rather than handing you a machine's chores.
By the Hosting & Domains team · Reviewed 18 August 2026
Beginner
Skill rating
5 minutes
Time budget
5
Steps in total
24/7
Support on call
No technical background needed. This walkthrough was written for first-timers, proven on our own hardware, and honest about which parts are genuinely tricky rather than merely unfamiliar.
First rule: read the snag section before you start, not afterwards. It was distilled from the tickets of everyone who tried the other order.
The whole job in one view
Over the whole job, you will open directory privacy, add logins for the people allowed in, check it from a private window, understand exactly what it covers and remove it on purpose.
No part of this needs code or a terminal unless the guide says so plainly — and where it does, the exact commands are printed. The step-by-step is below, with the surrounding sections supplying the context that makes it hold.
Where it comes off, and how to stay on
Locking wp-admin and breaking AJAX along with it. WordPress serves admin-ajax from that directory to signed-out visitors too, so either set the exceptions up carefully or guard a different folder.
Forewarned is genuinely forearmed here. This one mistake accounts for most of the frustration the topic ever causes — and it disappears entirely once somebody points it out.
A habit worth borrowing
Directory Privacy is the quickest privacy screen for a staging or preview site: one folder setting rather than building authentication into the application. Give the client one login and they can watch the build happen.
A minute spent now repays itself every time this job comes round again — and like almost every hosting job, come round it will.
The parts that look after themselves here
Steps that never deserved your time are taken out: certificates issue and reissue themselves, the installer handles application setup, the daily copy absorbs the what-ifs, and per-site settings live in a panel rather than a configuration file. The guide covers the remainder — the part that is actually about your site.
Stopped mid-guide at an awkward hour? That is exactly what round-the-clock support is for — say which step you are on and we take it from there.
Why this job is shorter on our plans
Tutorials written against imaginary hosting go stale fast. Ours are written against the real thing: the same panel, installer and defaults waiting in your account.
The rate you register at is the rate you renew at, so year two costs precisely what year one did — nothing lying in wait on the invoice.
- Every step checked exactly as published
- The snag named before it arrives
- The dull steps taken out of your way
- People reachable at any hour you stall
Why Hosting & Domains
Standard on every plan
Jargon never charges you
Every term is defined on the spot or linked to the jargon buster — nothing assumes prior knowledge.
The snag, flagged up front
The classic error for this particular task is named before step one, which is how 5 minutes stays 5 minutes.
5 steps, nothing padded
Each stage is a few minutes of steady clicking, and the fiddly moments are labelled fiddly.
Works exactly as printed
Every step is proven on the platform we run — none of the 'your host may vary' hedging.
Taken from real tickets
These guides came out of the support queue, so every snag flagged is one people genuinely hit.
The dull parts automated
SSL, backups and installs look after themselves here, leaving the guide to cover only what is genuinely yours.
Quick Start
Order placed to site online
- 1
Open Directory Privacy
cPanel → Directory Privacy → pick the folder → switch protection on and title the prompt. From then on the server asks for credentials before releasing anything inside.
- 2
Add logins for the people allowed in
Issue a username and password for each person or each purpose. These credentials belong to this folder alone and share nothing with any other account you run.
- 3
Check it from a private window
The browser's login box must appear before any content does. A session lingering in your everyday window can hide the protection from the very person testing it.
- 4
Understand exactly what it covers
It covers the whole subtree: files, nested folders and direct file URLs, all enforced by the web server before a line of application code runs.
- 5
Remove it on purpose
Protection that outlives its purpose turns real visitors away with no explanation. The staging password still live on launch day is the textbook case.
Built In
Fitted to every plan
- cPanel, which is what most of the industry already runs
- DDoS filtering absorbed at the network edge
- Your existing site brought across by our engineers, at no charge
- No set-up charge at any point, and no joining fee
- Staging copies for trying a change before it goes live
- WebP image optimisation built in, at no extra charge
- LiteSpeed caching in the server itself rather than bolted on by plugin
- WordPress and 400+ further applications installed in one click
- The name's first year included when you order annually
- 99.9% uptime as the target, watched around the clock
Frequently Asked
The questions that come up most
How does this differ from a WordPress login?
It works a layer lower down. The web server itself gates the folder before PHP even starts. An application login covers application routes; Directory Privacy covers everything physically under a path, direct file requests included.
Can Google index a folder I have protected?
It cannot. Crawlers meet the same 401 challenge as everybody else, so the content never reaches the index. That is also why forgotten protection makes pages fade quietly out of search results over the following weeks.
What happens when I outgrow the plan?
You upgrade in place. Plan changes are made from the client area with no migration and no downtime, and the range runs from small shared accounts through VPS to full dedicated machines. Growth becomes a setting on the account rather than a search for a new host.
Is the free SSL certificate genuinely free?
Entirely, on every plan. The certificate is issued as soon as the name points here and reissues itself well before it lapses. On encryption it matches any paid DV certificate — the paid options exist for wildcard coverage or organisation validation, which most sites never need.
Keep reading
How to Install WooCommerce
Get a working shop onto WordPress and push a test order all the way through — beginner level, about 45 minutes.
How to Back Up WordPress
Run backups that exist, restore cleanly, and hold up on the day they are needed — beginner level, about 30 minutes of setup.
DNS (Domain Name System) (Glossary)
The full definition, along with the practical consequence nobody bothers to mention.
Secure Hosting
Imunify360, isolated accounts and hardened defaults for security-first builds.
DirectAdmin Reseller Hosting
Lighter DirectAdmin reseller hosting at a lower monthly rate.
Changing hosts? Run through our checklist first.
A plain order of work for a move nobody visiting will notice: which files go over first, how to carry the mail across without losing a message, when exactly to repoint DNS, and the two mistakes behind nearly every outage we are asked to rescue.
Register it, then build on it.
From a first website to a rack of machines, moving up is a change to the account rather than a migration.
View Secure Hosting plans