How-to · Beginner · 5 minutes
How to Password Protect a Folder
Everything you need to put a login in front of a folder at the server, before your site ever sees the request — the steps in order, the snag to watch, and the tip our support desk gives everybody.
Straight answer first
In a line: put a login in front of a folder at the server, before your site ever sees the request — a beginner-level task that takes 5 minutes.
Below you get the exact steps, the classic snag, and a tip from the support desk. Where our platform handles a step for you, the guide says so rather than making you do the robot's work.
Written by the Hosting Seller staff · Checked 1 August 2026
Beginner
Skill needed
5
Stages to finish
Free
Help included
Tested
On our own kit
You do not need to be technical for this. The walkthrough is written for first-timers, tested on our own platform, and honest about which parts are genuinely fiddly and which are merely unfamiliar.
Rule of the road: read the snag section before you begin rather than after. It is harvested from the tickets of people who did it the other way round.
The whole job at a glance
From start to finish, you will open directory privacy, add the people who may in, test in a private window, know exactly what it covers and take it off on purpose.
No stage needs code or a terminal unless the guide says so outright, and where it does, the exact commands are printed. The full step-by-step sits below; the sections around it give the context that makes it stick.
Where this goes wrong, and how not to
Protecting wp-admin and taking AJAX down with it. WordPress serves admin-ajax from that folder to logged-out visitors as well, so either configure the exceptions properly or protect a different directory.
Forewarned really is forearmed here. This one mistake accounts for most of the frustration the subject produces, and it is entirely avoidable once somebody names it.
The trick worth borrowing
Directory Privacy is the quickest way to hide a staging or preview site: one folder setting instead of wiring privacy into the application. Hand the client a single login and they can watch the work in progress.
It costs a minute now and pays that back every time the job comes round again — which, like most hosting jobs, it certainly will.
What runs by itself here
We have automated the steps that do not deserve your time: certificates issue and reissue themselves, the installer handles application setup, the daily backup covers the what-if, and per-site settings live in a panel instead of a config file. The guide above covers what remains — the part that is actually about your site.
Stuck halfway through at an odd hour? That is exactly what round-the-clock human support is for — tell us where you are in this guide and we will pick it up from there.
The hosting this guide is written against
Tutorials age badly when they are written against imaginary hosting. These are written against ours: the same panel, the same installer and the same defaults you will meet.
SSL comes free with every plan and reissues itself before it lapses, so nobody has to diary the padlock.
- Step by step, tested exactly as printed
- The snag flagged before you reach it
- The dull steps are already automated
- People on hand at any hour if you stall
Why Hosting Seller
On every plan, as standard
No jargon toll
Terms are explained where they appear or linked to the glossary — nothing assumes you already know.
The snag, named early
The classic mistake for this exact job is flagged before step one, so 5 minutes stays 5 minutes.
5 steps, no filler
Each stage is a few minutes of steady clicking, with the fiddly parts marked as fiddly.
Works exactly as written
Every step tested on the platform we run — no 'your host may differ' hand-waving anywhere.
Written from real tickets
Our guides come off the support desk, so the snags flagged here are the ones people genuinely hit.
Automation where it belongs
SSL, backups and installs run themselves here, so the guide covers only what is genuinely yours to do.
First Steps
From choosing to live
- 1
Open Directory Privacy
cPanel → Directory Privacy → pick the folder → switch protection on and name the prompt. From that moment the server asks for credentials before it serves anything inside.
- 2
Add the people who may in
Create a username and password per person, or per purpose. These logins belong to the folder alone and have nothing to do with any other account you hold.
- 3
Test in a private window
The browser's authentication box should appear before any content does. An existing session in your normal window can hide the protection from the one person checking it.
- 4
Know exactly what it covers
Everything under the folder: files, subfolders and direct file addresses, all handled by the web server before a single line of application code runs.
- 5
Take it off on purpose
Protection that outlives its job blocks real visitors for no visible reason. The staging password still in place on launch day is the classic version of this story.
In the Box
Packed with every plan
- Nothing added at setup — no joining fee, ever
- DDoS filtering handled out at the network edge
- WebP image optimisation built in and costing nothing
- NVMe SSD storage on every shelf, not just the top one
- One-click installs for WordPress and 400+ other applications
- The renewal price printed on the tag matches the order price
- SSH, Git and Composer on the plans built for developers
- cPanel, the panel the rest of the trade already knows
- The Softaculous installer for one-click application setup
- A backup taken daily, with restores you run yourself
Across the Counter
The questions we get asked most
How is this different from a WordPress login?
It sits a layer earlier. The web server itself guards the folder before PHP starts. An application login protects application routes; Directory Privacy protects everything physically under a path, direct file access included.
Will Google index a protected folder?
No. Crawlers meet the same 401 challenge as everybody else, so the content stays out of the index entirely. It is also why protection left on by mistake makes pages quietly disappear from search over the following weeks.
What if the site outgrows the plan I bought?
You move up in place. Plan changes are made from the client area with no migration and no downtime, and the range runs from small shared accounts through VPS to whole dedicated servers. Growing becomes a line change on your account rather than a hunt for a new host.
Is the SSL certificate genuinely free?
On every plan, with nothing held back. The certificate is issued the moment your domain points here and reissues itself well before expiry. The encryption is the same as a paid DV certificate — paid tiers exist only for wildcard coverage or organisation validation, which most sites never need.
Does the price climb when the term is up?
No. What you pay to order is what you pay to renew, year after year. We do not run teaser rates, so there is no year-two ambush waiting in the calendar, and your bookkeeping can treat the hosting line as a fixed number.
What does round-the-clock support actually stretch to?
People at the counter at every hour, and a scope that takes in the practical work: mailbox setup, DNS records, WordPress trouble, restores. Not 'the server responds, ticket closed'. Ask us something hard before you order — the reply is a fair sample of what you would get afterwards.
What happens to my files if I leave?
The site and the files stay yours. Pull a full backup from the panel whenever you like, before or during cancellation. Domains remain registered in your name for the term you paid for and can move to any registrar once the standard 60-day window has passed.
Read next
How to Submit a Sitemap to Google
Hand search engines a complete map of what you want crawled — beginner level, about 15 minutes.
How to Optimize a MySQL Database
Keep queries quick as the data piles up year after year — advanced level, about an hour.
Charity Hosting
Reduced prices for charities and nonprofits, essentials still included.
Website Builder
Drag, drop and publish on quick hosting, with no code to write.
Packing up and moving host? Take our checklist.
A plain running order for a move nobody notices: what to copy first, how to carry email across without dropping a single message, when to point DNS, and the two slips behind nearly every hour of downtime we get called about.
Your site is worth better hosting.
Free SSL, a free move in, renewals charged at the order price, and human support around the clock. That is the whole offer.
See the plans