Password-Protect a Folder on Your Site

You can make the browser ask for a username and password before it shows a folder of your site. It's useful for a staging copy, an admin area, or files you only want to share with a few people.

This uses the web server's basic authentication (.htaccess + .htpasswd). The panel writes both files for you.

Use HTTPS. The browser sends this password with every request. Make sure the site has SSL and forces HTTPS before you rely on it.

1. Open the folder's options

1. Open the hosting control panel from the client area.
2. In the side menu, open Hosting Features → Htaccess.
3. Choose the domain and click Login.
4. The page lists folders under Global Directory Options (the site's html folder, which covers the whole site) and Per Directory Options (subfolders).
5. If the folder you want isn't listed, click + to open Add .htaccess file. Pick it in Directory, leave Status on Enabled, and click Add. The list only shows folders that already exist, so create the folder first in the file manager if needed.
6. Click the pencil next to the folder you want to protect. The Directory Options Management page opens.

2. Create at least one user

1. Next to htpasswd Users, click +.
2. Enter a Username and a Password, and confirm the password.
3. Click Save. Repeat for each person who needs access.

These users only exist for this folder. They aren't email accounts or panel users.

3. Turn on protection

1. Next to Password Protection, click the key icon.
2. Select Enabled.
3. Click Update.

Open the folder in a private browser window. You should see a login prompt.

Create the user before you enable protection. With protection on and no users, nobody can open the folder.

Turn protection off

On the same page, click the key next to Password Protection, select Disabled, and click Update.

Good to know

• Protection applies to the folder and everything inside it, including subfolders.
• If WordPress or another app lives in that folder, it may stop working for scripts that call it from outside (payment notifications, webhooks, cron URLs). Test after you enable it.
• This isn't a replacement for the app's own login. Use it as an extra layer.
• If you edited .htaccess by hand before, keep a copy: see Edit the .htaccess file.