{"id":8775,"date":"2009-07-15T22:44:20","date_gmt":"2009-07-15T17:14:20","guid":{"rendered":"https:\/\/www.quickonlinetips.com\/archives\/?p=8775"},"modified":"2026-10-07T07:19:04","modified_gmt":"2026-10-07T01:49:04","slug":"password-protect-directory-with-htaccess","status":"publish","type":"post","link":"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/","title":{"rendered":"How to Password Protect a Directory with .htaccess (2026 Guide)"},"content":{"rendered":"<p>Want to password protect a directory on your website, such as a staging site, admin area, downloads folder or client files? On Apache and LiteSpeed servers, you can do it with two small files, <strong>.htaccess<\/strong> and <strong>.htpasswd<\/strong>, and visitors will see a login box before they can open anything in that folder. I first set this up on our server back in 2009, and the method still works. Here&#8217;s how to password protect a directory with .htaccess safely in 2026, plus the one-click option in your hosting panel.<\/p>\n<p><img decoding=\"async\" class=\"aligncenter size-full wp-image-63380\" src=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-protect-directory-htaccess.webp\" alt=\"password protect a directory with .htaccess\" width=\"1200\" height=\"630\" srcset=\"https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-protect-directory-htaccess.webp 1200w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-protect-directory-htaccess-300x158.webp 300w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-protect-directory-htaccess-1024x538.webp 1024w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-protect-directory-htaccess-150x79.webp 150w, https:\/\/www.quickonlinetips.com\/archives\/wp-content\/uploads\/password-protect-directory-htaccess-768x403.webp 768w\" sizes=\"(max-width: 1200px) 100vw, 1200px\" \/><\/p>\n<p><strong>Quick answer:<\/strong> Create a <code>.htpasswd<\/code> file with a bcrypt-hashed username and password, store it outside your public folder, then add <code>AuthType Basic<\/code>, <code>AuthName<\/code>, <code>AuthUserFile<\/code> and <code>Require valid-user<\/code> to a <code>.htaccess<\/code> file inside the folder you want to protect. Make sure your site uses HTTPS.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_89 counter-hierarchy ez-toc-counter ez-toc-custom ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6ad5ecdb40660\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"ez-toc-cssicon\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #1a202c;color:#1a202c\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #1a202c;color:#1a202c\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-6ad5ecdb40660\" checked aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Easiest_way_use_your_hosting_control_panel\" >Easiest way: use your hosting control panel<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#How_to_password_protect_a_directory_with_htaccess_manually\" >How to password protect a directory with .htaccess manually<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Step_1_Create_the_htpasswd_file\" >Step 1: Create the .htpasswd file<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Step_2_Create_the_htaccess_file\" >Step 2: Create the .htaccess file<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Step_3_Upload_and_test\" >Step 3: Upload and test<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Security_tips\" >Security tips<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Password_protect_a_directory_on_Nginx\" >Password protect a directory on Nginx<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Frequently_asked_questions\" >Frequently asked questions<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Does_htaccess_password_protection_work_on_LiteSpeed\" >Does .htaccess password protection work on LiteSpeed?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#Can_I_protect_wp-admin_with_htaccess\" >Can I protect wp-admin with .htaccess?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.quickonlinetips.com\/archives\/2009\/07\/password-protect-directory-with-htaccess\/#How_do_I_remove_password_protection\" >How do I remove password protection?<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Easiest_way_use_your_hosting_control_panel\"><\/span>Easiest way: use your hosting control panel<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Most hosts can do this for you without editing files:<\/p>\n<ul>\n<li><strong>cPanel:<\/strong> open <strong>Files \u2192 Directory Privacy<\/strong>, choose the folder, tick <strong>Password protect this directory<\/strong>, then create a user. See <a href=\"https:\/\/docs.cpanel.net\/cpanel\/files\/directory-privacy\/\" target=\"_blank\" rel=\"noopener\">cPanel\u2019s Directory Privacy guide<\/a>.<\/li>\n<li><strong>Hostinger hPanel:<\/strong> go to <strong>Advanced \u2192 Password Protect Directories<\/strong>, pick the folder and add a username and password.<\/li>\n<li><strong>Plesk:<\/strong> use <strong>Websites &amp; Domains \u2192 Password-Protected Directories<\/strong>.<\/li>\n<\/ul>\n<p>The panel creates the same .htaccess and .htpasswd files described below.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"How_to_password_protect_a_directory_with_htaccess_manually\"><\/span>How to password protect a directory with .htaccess manually<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Suppose you want to protect a folder called <code>private<\/code> at <code>\/home\/user\/public_html\/private\/<\/code>.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Step_1_Create_the_htpasswd_file\"><\/span>Step 1: Create the .htpasswd file<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>The .htpasswd file stores usernames and hashed passwords, one per line. If you have SSH access, use Apache&#8217;s <a href=\"https:\/\/httpd.apache.org\/docs\/current\/programs\/htpasswd.html\" target=\"_blank\" rel=\"noopener\">htpasswd tool<\/a> with bcrypt (<code>-B<\/code>), the most secure option:<\/p>\n<pre><code>htpasswd -c -B \/home\/user\/.htpasswd alice<\/code><\/pre>\n<p>It asks for a password and creates a line like:<\/p>\n<pre><code>alice:$2y$05$r5Gh8kQ0nZ...rest-of-bcrypt-hash<\/code><\/pre>\n<p>Leave out <code>-c<\/code> when adding more users, or it overwrites the file. Without SSH, use your hosting panel, or generate a bcrypt line with a trusted generator and paste it in. Avoid old &#8220;crypt&#8221; hashes, which are weak and only use the first 8 characters of the password.<\/p>\n<p><strong>Keep .htpasswd outside your public web folder<\/strong> (for example <code>\/home\/user\/.htpasswd<\/code> rather than inside <code>public_html<\/code>), so it can never be downloaded.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Step_2_Create_the_htaccess_file\"><\/span>Step 2: Create the .htaccess file<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Inside the <code>private<\/code> folder, create a file named <code>.htaccess<\/code> (or add to it if one exists) with:<\/p>\n<pre><code>AuthType Basic\r\nAuthName \"Restricted area\"\r\nAuthUserFile \/home\/user\/.htpasswd\r\nRequire valid-user<\/code><\/pre>\n<p><code>AuthUserFile<\/code> must be the full server path, not a URL. Ask your host or check your File Manager for the exact path. <code>AuthName<\/code> is the message shown in the login box.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Step_3_Upload_and_test\"><\/span>Step 3: Upload and test<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Upload the files with your host&#8217;s File Manager or an FTP client like <a href=\"https:\/\/filezilla-project.org\/\" target=\"_blank\" rel=\"noopener\">FileZilla<\/a> (turn on <strong>Server \u2192 Force showing hidden files<\/strong> to see files starting with a dot). Open the folder in a private browser window: you should get a login prompt. If it keeps asking, check the username, password and the AuthUserFile path. If you get a 500 error, there&#8217;s a typo in .htaccess.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Security_tips\"><\/span>Security tips<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<ul>\n<li><strong>Use HTTPS:<\/strong> Basic authentication only encodes the password, it doesn&#8217;t encrypt it, so it must run over HTTPS.<\/li>\n<li><strong>Use strong, unique passwords<\/strong> and remove users who no longer need access.<\/li>\n<li><strong>Protect a single file<\/strong> by wrapping the rules in <code>&lt;Files \"report.pdf\"&gt; ... &lt;\/Files&gt;<\/code>.<\/li>\n<li><strong>Back up .htaccess<\/strong> before editing. A mistake can take your whole site down.<\/li>\n<\/ul>\n<h2><span class=\"ez-toc-section\" id=\"Password_protect_a_directory_on_Nginx\"><\/span>Password protect a directory on Nginx<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Nginx doesn&#8217;t read .htaccess files. Add this to your server block instead and reload Nginx:<\/p>\n<pre><code>location \/private\/ {\r\n    auth_basic \"Restricted area\";\r\n    auth_basic_user_file \/etc\/nginx\/.htpasswd;\r\n}<\/code><\/pre>\n<p>For a single page rather than a folder, see these <a href=\"https:\/\/www.quickonlinetips.com\/archives\/2005\/02\/simple-scripts-to-password-protect-your-webpage\/\">ways to password protect a web page<\/a>. WordPress also has a built-in password option for individual posts and pages.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"Frequently_asked_questions\"><\/span>Frequently asked questions<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h3><span class=\"ez-toc-section\" id=\"Does_htaccess_password_protection_work_on_LiteSpeed\"><\/span>Does .htaccess password protection work on LiteSpeed?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes. LiteSpeed Web Server reads Apache .htaccess rules, including Basic authentication.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Can_I_protect_wp-admin_with_htaccess\"><\/span>Can I protect wp-admin with .htaccess?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Yes, adding a second password to <code>\/wp-admin\/<\/code> blocks many brute-force attacks. Exclude <code>admin-ajax.php<\/code> so front-end features keep working.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"How_do_I_remove_password_protection\"><\/span>How do I remove password protection?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Delete the four auth lines from .htaccess, or turn off protection in your hosting panel. You can then delete the .htpasswd file.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Want to password protect a directory on your website, such as a staging site, admin area, downloads folder or client&#8230;<\/p>\n","protected":false},"author":4,"featured_media":63380,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_kad_post_transparent":"default","_kad_post_title":"default","_kad_post_layout":"default","_kad_post_sidebar_id":"","_kad_post_content_style":"default","_kad_post_vertical_padding":"default","_kad_post_feature":"","_kad_post_feature_position":"","_kad_post_header":false,"_kad_post_footer":false,"_kad_post_classname":"","footnotes":""},"categories":[6,7],"tags":[49],"class_list":["post-8775","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blogging","category-security","tag-tutorials"],"_links":{"self":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/8775","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/comments?post=8775"}],"version-history":[{"count":1,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/8775\/revisions"}],"predecessor-version":[{"id":63381,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/posts\/8775\/revisions\/63381"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media\/63380"}],"wp:attachment":[{"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/media?parent=8775"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/categories?post=8775"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.quickonlinetips.com\/archives\/wp-json\/wp\/v2\/tags?post=8775"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}