{"id":247265,"date":"2026-01-05T11:52:59","date_gmt":"2026-01-05T11:52:59","guid":{"rendered":"https:\/\/www.bluehost.com\/blog\/?p=247265"},"modified":"2026-02-10T04:52:41","modified_gmt":"2026-02-10T04:52:41","slug":"password-protect-a-folder-on-your-website","status":"publish","type":"post","link":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/","title":{"rendered":".htaccess\u00a0Password\u00a0Folder &amp; Directory Protection Tutorial\u00a0"},"content":{"rendered":"\n<h3 class=\"wp-block-heading\" id=\"h-key-nbsp-highlights-nbsp\"><strong>Key&nbsp;highlights<\/strong>&nbsp;<\/h3>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Secure staging areas, client projects, private&nbsp;downloads&nbsp;and&nbsp;admin-only resources from unauthorized access.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Secure entire folders with&nbsp;.htaccess&nbsp;password protection in minutes,&nbsp;no coding knowledge required through our intuitive interface.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Learn the basics of these two files that control Apache HTTP authentication and directory access rules.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Go beyond folder-level security by protecting specific files using .htaccess&nbsp;file directives.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Safely disable password prompts through cPanel or by editing .htaccess&nbsp;configuration files.&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Validate your setup&nbsp;works&nbsp;correctly and avoid common errors that could lock you out or break your site.&nbsp;<\/li>\n<\/ul>\n\n\n\n<p>When&nbsp;you&#8217;re&nbsp;running a website, there are times when you need to&nbsp;<a href=\"https:\/\/www.bluehost.com\/help\/article\/create-ip-blocker-account-manager\">restrict access to certain areas<\/a>.&nbsp;Maybe you&nbsp;have a staging site&nbsp;you&#8217;re&nbsp;testing before going live, client files that need to stay private&nbsp;or&nbsp;downloadable resources meant only for paying customers. Without proper protection, these&nbsp;<a href=\"https:\/\/www.bluehost.com\/help\/article\/password-protect-a-folder-on-your-website\">sensitive folders and files<\/a>&nbsp;remain&nbsp;exposed to anyone who stumbles across the&nbsp;URL&nbsp;&#8211;&nbsp;putting your content, your clients&#8217;&nbsp;assets&nbsp;or your business at risk.&nbsp;<\/p>\n\n\n\n<p>The good news? You can password protect a directory using HTTP authentication through an .htaccess&nbsp;file or the&nbsp;<a href=\"https:\/\/www.bluehost.com\/help\/article\/am-directory-privacy\">cPanel Directory Privacy feature<\/a>. This method prompts visitors with a username and password dialog box right in their browser before they can access the protected content.&nbsp;It&#8217;s&nbsp;a straightforward, server-level security layer that works independently from your website&#8217;s application (like WordPress login). Keep in mind, this&nbsp;isn&#8217;t&nbsp;a replacement for full user authentication&nbsp;systems,it&#8217;s&nbsp;designed for quick, folder-level access control.&nbsp;<\/p>\n\n\n\n<p>To follow along,&nbsp;you&#8217;ll&nbsp;need access to your web hosting account, specifically cPanel or File Manager.&nbsp;You&#8217;ll&nbsp;be&nbsp;<a href=\"https:\/\/www.bluehost.com\/blog\/wordpress-htaccess-file-how-to-use-edit\/\">editing WordPress .htaccess&nbsp;files<\/a>, so careful editing matters. In this guide,&nbsp;we&#8217;ll&nbsp;walk you through both the easy cPanel method and the manual approach to password protect a directory with .htaccess, showing you exactly where to make changes and how to secure your website&#8217;s&nbsp;private areas&nbsp;effectively.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-secure-nbsp-website-nbsp-folders-or-nbsp-files-nbsp\"><strong>Secure&nbsp;website&nbsp;folders or&nbsp;files<\/strong>&nbsp;<\/h2>\n\n\n\n<p>When you set up password protection for a folder or individual files on your website,&nbsp;<a href=\"https:\/\/www.bluehost.com\/blog\/how-to-manage-user-access-on-your-website\/\">user authentication is required<\/a>&nbsp;to gain access.&nbsp;With password-protected folders or files, you can restrict unauthorized access, thus&nbsp;<a href=\"https:\/\/www.bluehost.com\/blog\/how-to-protect-your-site-against-hackers\/\">protecting your site from hackers<\/a>&nbsp;from hackers.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-password-protecting-your-site-with-an-htaccess-nbsp-file-nbsp\"><strong>Password protecting your site with an .htaccess&nbsp;file<\/strong>&nbsp;<\/h2>\n\n\n\n<p>Password protecting your website with an .htaccess&nbsp;file works through Apache HTTP authentication, a&nbsp;security feature built into most web servers. When someone tries to access a protected directory, Apache checks two key files: the&nbsp;.htaccess&nbsp;file (a configuration file that sets rules for your directory) and the&nbsp;.htpasswd&nbsp;file (which stores usernames and hashed passwords). Together, these files create a browser login prompt before visitors can view your protected content.&nbsp;<\/p>\n\n\n\n<p>You have two main paths for password protection.&nbsp;cPanel Directory Privacy&nbsp;is the easiest&nbsp;option,it&nbsp;automatically creates both files and manages users through a simple interface, making it ideal for protecting entire folders quickly.&nbsp;<a href=\"https:\/\/www.bluehost.com\/hosting\/help\/2139\">Direct .htaccess&nbsp;file editing<\/a>&nbsp;gives you more control when you need to password protect a single file, apply custom&nbsp;rules&nbsp;or use advanced patterns like protecting only certain file types. If&nbsp;you&#8217;re&nbsp;just starting out or protecting a standard folder, use cPanel Directory Privacy. If you need granular file-level control, edit .htaccess&nbsp;directly.&nbsp;<\/p>\n\n\n\n<p>Before you start, complete this quick checklist: back up your existing .htaccess&nbsp;file (if one exists), confirm your hosting uses Apache (most shared hosting does), know the full server path to the directory you&#8217;re protecting and avoid making changes on a live production site without a rollback plan. Even a small&nbsp;<a href=\"https:\/\/www.bluehost.com\/help\/article\/500-internal-server-error-help\">.htaccess&nbsp;configuration errors<\/a>&nbsp;can break your site, so test changes carefully.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-the-htaccess-nbsp-file-nbsp\"><strong>The .htaccess&nbsp;file<\/strong>&nbsp;<\/h3>\n\n\n\n<p>The .htaccess&nbsp;file is a directory-level configuration file that controls how your Apache web server handles requests to a specific folder. When you set up password protection, this file tells Apache to require authentication before displaying any content in that directory. It typically lives inside the folder&nbsp;you&#8217;re&nbsp;protecting,&nbsp;for example, if&nbsp;you&#8217;re&nbsp;securing a folder called &#8220;private,&#8221; the .htaccess&nbsp;file sits directly inside that folder.&nbsp;<\/p>\n\n\n\n<p>Before you make any changes to .htaccess, always create a backup copy. Even a small typo,&nbsp;like a missing closing tag or incorrect file path,&nbsp;can trigger a 500 Internal Server Error and break your entire site. Edit carefully, double-check your&nbsp;syntax&nbsp;and test your changes in a private browsing window to ensure password prompts appear correctly without cached credentials interfering. This cautious approach keeps your site running smoothly while securing your sensitive content.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-editing-the-htpasswd-nbsp-file-nbsp\"><strong>Editing the .htpasswd&nbsp;file<\/strong>&nbsp;<\/h3>\n\n\n\n<p>The .htpasswd&nbsp;file stores your authentication&nbsp;credentials,each&nbsp;username paired with a cryptographically hashed version of its password. For security, this file should live outside your public web root (typically in a path like&nbsp;\/home\/[username]\/.htpasswds\/) so visitors&nbsp;can&#8217;t&nbsp;accidentally access it through their browser. When you need to update credentials, use Directory Privacy to add a new user or&nbsp;modify&nbsp;an existing password.&nbsp;<\/p>\n\n\n\n<p>Before&nbsp;making any changes, verify&nbsp;that the AuthUserFile path in your .htaccess&nbsp;file matches the actual location of your .htpasswd&nbsp;file,&nbsp;a&nbsp;mismatch will lock you out entirely. After updating passwords, always test access in an incognito or private browser window since your regular browser may cache old login credentials and give a false positive that access works when it&nbsp;doesn&#8217;t.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-access-the-directory-privacy-tool-nbsp\"><strong>How to access the Directory Privacy Tool?<\/strong>&nbsp;<\/h2>\n\n\n\n<p>Before you can password protect a folder, you need to access the Directory Privacy tool in your hosting dashboard. The steps differ slightly depending on whether your plan uses cPanel or Bluehost\u2019s Account Manager.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-option-nbsp-a-recommended-from-account-manager-no-cpanel-nbsp-nbsp\"><strong>Option&nbsp;A (recommended): from Account Manager (no cPanel)&nbsp;<\/strong>&nbsp;<\/h3>\n\n\n\n<ul start=\"1\" class=\"wp-block-list\">\n<li>Log in to your&nbsp;<strong>Bluehost Account Manager<\/strong>.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul start=\"2\" class=\"wp-block-list\">\n<li>Click&nbsp;<strong>Websites<\/strong>&nbsp;in the left menu.&nbsp;&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"447\" src=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Go-to-websites-1024x447.png\" alt=\"Go to websites \" class=\"wp-image-260979\" srcset=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Go-to-websites-1024x447.png 1024w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Go-to-websites-300x131.png 300w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Go-to-websites-768x335.png 768w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Go-to-websites-480x209.png 480w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Go-to-websites-1000x436.png 1000w\" sizes=\"100vw\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Click&nbsp;<strong>Manage&nbsp;<\/strong>for the site you want&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"447\" src=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-manage-3-1024x447.png\" alt=\"Click on manage\" class=\"wp-image-260980\" srcset=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-manage-3-1024x447.png 1024w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-manage-3-300x131.png 300w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-manage-3-768x335.png 768w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-manage-3-480x209.png 480w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-manage-3-1000x436.png 1000w\" sizes=\"100vw\" \/><\/figure>\n\n\n\n<ul start=\"4\" class=\"wp-block-list\">\n<li>Open the&nbsp;<strong>Files &amp; Access<\/strong>&nbsp;tab.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul start=\"5\" class=\"wp-block-list\">\n<li>In&nbsp;<strong>Directory Privacy<\/strong>, click&nbsp;<strong>Manage<\/strong>.&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"549\" src=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-on-directory-privacy-1024x549.png\" alt=\"In Directory Privacy, click Manage.  \" class=\"wp-image-260981\" srcset=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-on-directory-privacy-1024x549.png 1024w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-on-directory-privacy-300x161.png 300w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-on-directory-privacy-768x412.png 768w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-on-directory-privacy-480x257.png 480w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Click-on-directory-privacy-1000x536.png 1000w\" sizes=\"100vw\" \/><\/figure>\n\n\n\n<p>You&#8217;ve&nbsp;accessed the Directory Privacy section where you can password protect directory contents to secure sensitive folders on your website. This essential feature allows you to control access and add an extra layer of protection to specific directories.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-option-nbsp-b-still-valid-for-some-plans-via-cpanel-nbsp-nbsp\"><strong>Option&nbsp;B (still valid for some plans): via cPanel&nbsp;<\/strong>&nbsp;<\/h3>\n\n\n\n<ul start=\"1\" class=\"wp-block-list\">\n<li>Log in to your&nbsp;<strong>Bluehost Account Manager.<\/strong>&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul start=\"2\" class=\"wp-block-list\">\n<li>Click&nbsp;<strong>Hosting&nbsp;<\/strong>in the left menu.&nbsp;&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"455\" src=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Hosting-and-then-cPanel-1024x455.png\" alt=\"Click\u00a0Hosting\" class=\"wp-image-260982\" srcset=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Hosting-and-then-cPanel-1024x455.png 1024w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Hosting-and-then-cPanel-300x133.png 300w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Hosting-and-then-cPanel-768x341.png 768w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Hosting-and-then-cPanel-480x213.png 480w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Hosting-and-then-cPanel-1000x444.png 1000w\" sizes=\"100vw\" \/><\/figure>\n\n\n\n<ul start=\"3\" class=\"wp-block-list\">\n<li>On the hosting details page, click&nbsp;<strong>CPANEL&nbsp;<\/strong>(it opens in a new tab).&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<ul start=\"4\" class=\"wp-block-list\">\n<li><strong>In cPanel,<\/strong>&nbsp;go to the&nbsp;<strong>Files section&nbsp;<\/strong>and click&nbsp;<strong>Directory Privacy. (This part is the standard cPanel location.)&nbsp;<\/strong>&nbsp;&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"566\" src=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Directory-privacy-in-cPanel-1024x566.png\" alt=\"click\u00a0Directory Privacy\" class=\"wp-image-260983\" srcset=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Directory-privacy-in-cPanel-1024x566.png 1024w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Directory-privacy-in-cPanel-300x166.png 300w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Directory-privacy-in-cPanel-768x424.png 768w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Directory-privacy-in-cPanel-480x265.png 480w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Directory-privacy-in-cPanel-1000x552.png 1000w\" sizes=\"100vw\" \/><\/figure>\n\n\n\n<p><strong>Note:<\/strong>\u00a0Bluehost for agencies hosting\u00a0doesn\u2019t\u00a0include cPanel, so Option A is the one that applies there.\u00a0\u00a0\u00a0<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-nbsp-password-nbsp-protect-a-nbsp-website-nbsp-folder-nbsp\"><strong>How to&nbsp;password&nbsp;protect a&nbsp;website&nbsp;folder?<\/strong>&nbsp;<\/h2>\n\n\n\n<p>This approach helps you secure a full folder along with all its contents. You can set it up easily using the Directory Privacy tool without editing server files manually.<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>In the Directory Privacy tool, navigate the folder structure. Click the&nbsp;<strong>folder icon<\/strong>&nbsp;to open a&nbsp;folder, or&nbsp;click the&nbsp;<strong>folder name<\/strong>&nbsp;to select it for protection.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li>Select the directory you wish to protect. You will see a settings screen for that specific folder.&nbsp;<\/li>\n<\/ol>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"520\" src=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Select-the-directory-you-wish-to-protect-1024x520.png\" alt=\"Select the directory you wish to protect\" class=\"wp-image-260984\" srcset=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Select-the-directory-you-wish-to-protect-1024x520.png 1024w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Select-the-directory-you-wish-to-protect-300x152.png 300w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Select-the-directory-you-wish-to-protect-768x390.png 768w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Select-the-directory-you-wish-to-protect-480x244.png 480w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Select-the-directory-you-wish-to-protect-1000x508.png 1000w\" sizes=\"100vw\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Check the box labeled&nbsp;<strong>Password protect this directory<\/strong>&nbsp;<\/li>\n<\/ul>\n\n\n\n<figure class=\"wp-block-image size-large\"><img decoding=\"async\" width=\"1024\" height=\"396\" src=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Check-the-box-labeled-Password-protect-this-directory-1024x396.png\" alt=\"Check the box labeled\u00a0Password protect this directory\u00a0\" class=\"wp-image-260985\" srcset=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Check-the-box-labeled-Password-protect-this-directory-1024x396.png 1024w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Check-the-box-labeled-Password-protect-this-directory-300x116.png 300w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Check-the-box-labeled-Password-protect-this-directory-768x297.png 768w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Check-the-box-labeled-Password-protect-this-directory-480x185.png 480w, https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/10\/Check-the-box-labeled-Password-protect-this-directory-1000x386.png 1000w\" sizes=\"100vw\" \/><\/figure>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Enter a name for the protected directory. This label will appear in the login prompt when someone accesses the directory. Click the&nbsp;<strong>Save<\/strong>&nbsp;button.&nbsp;<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-password-protect-a-website-file-nbsp\"><strong>How to password protect a website file?<\/strong>&nbsp;<\/h2>\n\n\n\n<p>When&nbsp;you&nbsp;password protect&nbsp;a directory using the tool above, the system automatically writes configurations into a file called &#8216;.htaccess&#8217; located in that protected folder.&nbsp;<\/p>\n\n\n\n<p><strong>Note:<\/strong>&nbsp;For step-by-step instructions on accessing and editing files manually, check out our guide on&nbsp;&#8211;&nbsp;<a href=\"https:\/\/www.bluehost.com\/help\/article\/navigating-the-file-manager\">How to Navigate the File Manager<\/a>.&nbsp;<\/p>\n\n\n\n<p>Inside the&nbsp;.htaccess&nbsp;file, you will see statements&nbsp;similar to&nbsp;the following:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>AuthType Basic\nAuthName \"Restricted Area\"\nAuthUserFile \"\/home\/&#91;username]\/.htpasswds\/public_html\/passwd\"\nRequire valid-user<\/code><\/pre>\n\n\n\n<p>To protect a&nbsp;single specific file&nbsp;instead of the entire folder, you need to&nbsp;modify&nbsp;the .htaccess&nbsp;file manually. You will wrap the authentication code in tags.&nbsp;<\/p>\n\n\n\n<p>In this example, we will protect the file &#8216;secure.html.&#8217; Modify your&nbsp;.htaccess&nbsp;file as follows:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;Files \"secure.html\"&gt;\n  AuthType Basic\n  AuthName \"Restricted Area\"\n  AuthUserFile \"\/home\/&#91;username]\/.htpasswds\/public_html\/passwd\"\n  Require valid-user\n&lt;\/Files&gt;<\/code><\/pre>\n\n\n\n<p>You can also protect multiple files that match a specific pattern using Apache\u2019s&nbsp;FilesMatch&nbsp;directive. This allows you to list regex patterns for files:&nbsp;<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;FilesMatch \"\\.(pdf|docx|html)$\"&gt;\n  AuthType Basic\n  AuthName \"Restricted Area\"\n  AuthUserFile \"\/home\/&#91;username]\/.htpasswds\/public_html\/passwd\"\n  Require valid-user\n&lt;\/FilesMatch&gt;<\/code><\/pre>\n\n\n\n<p><strong>Important:<\/strong>&nbsp;When configuring password&nbsp;protect&nbsp;directory settings, verify that the&nbsp;AuthUserFile&nbsp;path in your .htaccess&nbsp;file accurately points to where your .htpasswd&nbsp;file is stored on your server to ensure proper authentication and directory protection.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-create-the-htaccess-nbsp-file-nbsp\"><strong>Create the .htaccess&nbsp;file<\/strong>&nbsp;<\/h3>\n\n\n\n<p>If your directory&nbsp;doesn&#8217;t&nbsp;already have an .htaccess&nbsp;file,&nbsp;you&#8217;ll&nbsp;need to create one manually via File Manager:&nbsp;<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Open cPanel&nbsp;<strong>File Manager<\/strong>&nbsp;and ensure &#8220;Show Hidden Files&#8221; is checked in the&nbsp;<strong>Settings<\/strong>&nbsp;(top right corner).&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li>Locate and access the directory you want to password protect.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Click&nbsp;<strong>+ File<\/strong>&nbsp;(New File)&nbsp;in&nbsp;the top left. Name it exactly&nbsp;.htaccess&nbsp;(with the dot at the start).&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"4\" class=\"wp-block-list\">\n<li>Right-click the new file and select&nbsp;<strong>Edit<\/strong>&nbsp;to add your code.&nbsp;<\/li>\n<\/ol>\n\n\n\n<h3 class=\"wp-block-heading\" id=\"h-how-to-password-protect-your-entire-wordpress-site-nbsp\"><strong>How to password protect your entire WordPress site?<\/strong>&nbsp;<\/h3>\n\n\n\n<p>Protecting your entire WordPress site with a password works well for&nbsp;<a href=\"https:\/\/www.bluehost.com\/help\/article\/wordpress-how-to-create-a-staging-site\">WordPress staging sites<\/a>, under-construction pages, client&nbsp;reviews&nbsp;or&nbsp;private membership previews. Keep in mind that site-wide password protection blocks search engines from indexing your content and requires sharing credentials with authorized users. Before you&nbsp;proceed, back up your site completely, test in a safe environment first and&nbsp;confirm&nbsp;you&nbsp;retain&nbsp;admin access.&nbsp;<\/p>\n\n\n\n<p><strong>How to password protect directory access across your entire website:<\/strong>&nbsp;<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li><strong>Server-level HTTP authentication<\/strong>: Use Directory Privacy (explained above) on your root&nbsp;public_html&nbsp;folder to password-protect the directory. This creates a browser login prompt before WordPress loads, providing the strongest site-wide control.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li><strong>WordPress visibility settings<\/strong>: Navigate to Settings &gt; Reading to discourage search engines, then password-protect pages or adjust site visibility settings as needed.&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><a href=\"https:\/\/www.bluehost.com\/in\/blog\/how-to-put-a-wordpress-site-in-maintenance-mode\/\"><strong>WordPress maintenance mode<\/strong><\/a>: Enable a coming-soon or under-construction display through your WordPress dashboard for temporary access restrictions without&nbsp;modifying&nbsp;server files.&nbsp;<\/li>\n<\/ol>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-password-protect-individual-pages-nbsp\"><strong>How to password protect individual pages?<\/strong>&nbsp;<\/h2>\n\n\n\n<p>Protecting individual pages is common when you need to share specific content privately\u2014like a client proposal page, exclusive landing&nbsp;page&nbsp;or&nbsp;temporary campaign preview\u2014without locking down your entire site. You have two main approaches: server-level protection using .htaccess&nbsp;or WordPress&#8217;s built-in page password feature.&nbsp;<\/p>\n\n\n\n<p>For server-level protection, you can use the same .htaccess&nbsp;method described earlier with tags, targeting the specific page file (like proposal.html). This works well when you need strong HTTP authentication&nbsp;that&#8217;s&nbsp;independent of WordPress, ideal for non-WordPress pages or when you&nbsp;want&nbsp;browser-level security prompts.&nbsp;&nbsp;<\/p>\n\n\n\n<p>However, WordPress offers a simpler&nbsp;option: its native page password&nbsp;feature&nbsp;in the editor&#8217;s visibility settings. This lets&nbsp;you&nbsp;password-protect individual posts or pages directly from your dashboard without touching server files, making it perfect for quick, user-friendly protection.&nbsp;<\/p>\n\n\n\n<figure class=\"wp-block-table\"><table class=\"has-fixed-layout\"><tbody><tr><td><strong>Method<\/strong>&nbsp;<\/td><td><strong>Best&nbsp;for<\/strong>&nbsp;<\/td><\/tr><tr><td>Server-level (.htaccess)&nbsp;<\/td><td>Static pages, non-WordPress content, stronger security layer&nbsp;<\/td><\/tr><tr><td>WordPress page password&nbsp;<\/td><td>Quick setup, blog posts, client previews, no technical skills needed&nbsp;<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<p>After applying protection, always test in an incognito window to confirm only your target page prompts for credentials while the rest of your site&nbsp;remains&nbsp;accessible.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-create-a-user-nbsp\"><strong>How to create a user?<\/strong>&nbsp;<\/h2>\n\n\n\n<p>After you enable password protection for the directory (and click&nbsp;<strong>Save<\/strong>, then&nbsp;<strong>Go Back<\/strong>), use the&nbsp;<strong>Create User<\/strong>&nbsp;section:&nbsp;<\/p>\n\n\n\n<ol start=\"1\" class=\"wp-block-list\">\n<li>Enter a&nbsp;<strong>Username<\/strong>.&nbsp;&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"2\" class=\"wp-block-list\">\n<li>Enter and confirm the&nbsp;<strong>Password<\/strong>&nbsp;(or use&nbsp;<strong>Password Generator<\/strong>, if shown).&nbsp;&nbsp;<\/li>\n<\/ol>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li>Click&nbsp;<strong>Save<\/strong>.&nbsp;<\/li>\n<\/ol>\n\n\n\n<p><strong>Result:<\/strong>&nbsp;That folder will now prompt for this username\/password. You can add more users, change&nbsp;passwords&nbsp;or&nbsp;delete&nbsp;users from the authorized users list.&nbsp;&nbsp;<\/p>\n\n\n\n<p><strong>Note:<\/strong>&nbsp;If you cannot create a user, update the directory permissions to&nbsp;<strong>0700<\/strong>&nbsp;in cPanel\u2019s File Manager.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-how-to-remove-a-page-nbsp-folder-nbsp-or-site-password-nbsp\"><strong>How to remove a page,&nbsp;folder&nbsp;or site password?<\/strong>&nbsp;<\/h2>\n\n\n\n<p>Removing password protection is straightforward. Whether you used cPanel&#8217;s Directory Privacy tool or manually edited .htaccess&nbsp;files, follow these steps to unlock your content.&nbsp;<\/p>\n\n\n\n<p><strong>Using Directory Privacy (cPanel):<\/strong>&nbsp;Navigate back to the Directory Privacy tool in cPanel and select the protected directory. Uncheck the &#8220;Password&nbsp;protect&nbsp;this directory&#8221; box and click&nbsp;<strong>Save<\/strong>. This automatically removes the authentication code from the .htaccess&nbsp;file.&nbsp;<\/p>\n\n\n\n<p><strong>Manual .htaccess&nbsp;Method:<\/strong>&nbsp;Open the .htaccess&nbsp;file in File Manager. Delete (or comment out with&nbsp;#) the lines starting with&nbsp;AuthType,&nbsp;AuthName,&nbsp;AuthUserFile&nbsp;and&nbsp;Require. If you wrapped them in tags, remove the entire block.&nbsp;<\/p>\n\n\n\n<p><strong>Validation:<\/strong>&nbsp;Always test your site in an incognito window after removing protection to ensure the login prompt is gone and no&nbsp;<a href=\"https:\/\/www.bluehost.com\/help\/article\/how-to-clear-your-browser-cache\" target=\"_blank\" rel=\"noreferrer noopener\">cached credentials<\/a>&nbsp;remain.&nbsp;<\/p>\n\n\n\n<p><strong>Also read:&nbsp;<\/strong><a href=\"https:\/\/www.bluehost.com\/blog\/url-redirect-rewrite-using-the-htaccess-file\/\">How to Redirect URL Using an .htaccess&nbsp;File?<\/a>&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-final-nbsp-thoughts-nbsp\"><strong>Final&nbsp;thoughts<\/strong>&nbsp;<\/h2>\n\n\n\n<p>Password protecting folders and files with .htaccess&nbsp;gives you precise control over who accesses sensitive areas of your website. Whether&nbsp;you&#8217;re&nbsp;securing client files, protecting staging environments or limiting access to admin resources, HTTP authentication adds a valuable security layer.&nbsp;You&#8217;ve&nbsp;learned two main approaches: using cPanel&#8217;s Directory Privacy tool for quick folder protection and editing .htaccess&nbsp;directives with tags when you need to protect individual files.&nbsp;<\/p>\n\n\n\n<p>This method works well for its intended purpose, but&nbsp;it&#8217;s&nbsp;just one piece of&nbsp;your&nbsp;<a href=\"https:\/\/www.bluehost.com\/blog\/website-security\/\">overall website security strategy<\/a>. Beyond restricting directory access, take time to review your site&#8217;s broader security fundamentals,&nbsp;ensuring you have an&nbsp;<a href=\"https:\/\/www.bluehost.com\/help\/article\/google-security\">SSL certificate protection<\/a>, regular backups and a plan for keeping your software updated.&nbsp;<\/p>\n\n\n\n<p>As your website grows, choosing a&nbsp;<a href=\"https:\/\/www.bluehost.com\/blog\/how-to-choose-a-web-hosting-service\/\">hosting provider with strong security features<\/a>&nbsp;and ease of management becomes increasingly important. Look for plans that include&nbsp;<a href=\"https:\/\/www.bluehost.com\/blog\/cloud-hosting-security-features\/\">built-in security features<\/a>, automatic updates and 24\/7 expert support to help you implement and&nbsp;maintain&nbsp;protections without hassle. With the right hosting foundation and security practices working together, you can protect your content and focus on what matters&nbsp;most,&nbsp;building&nbsp;your online presence.&nbsp;<\/p>\n\n\n\n<p>If you\u2019re looking for a hosting solution that makes security easier to manage, Bluehost offers built-in tools like Directory Privacy, free SSL certificates, automated backups and 24\/7 expert support. With these features in place, you can confidently secure sensitive files and folders while spending less time on technical setup and more time growing your website. Explore <a href=\"https:\/\/www.bluehost.com\/web-hosting\">Bluehost web hosting plans today<\/a>!<\/p>\n\n\n\n<svg version=\"1.1\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" xmlns:xlink=\"http:\/\/www.w3.org\/1999\/xlink\" viewBox=\"0 0 1001 300\"> \n\n  <image width=\"1001\" height=\"300\" xlink:href=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2025\/03\/Hosting-2.png\"><\/image> <a xlink:href=\"https:\/\/www.bluehost.com\/web-hosting \"> \n\n    <rect x=\"84\" y=\"180\" fill=\"#fff\" opacity=\"0\" width=\"187\" height=\"63\"><\/rect> \n\n  <\/a> \n\n<\/svg>\n\n\n\n<h2 class=\"wp-block-heading\" id=\"h-faqs\"><strong>FAQs<\/strong><\/h2>\n\n\n\n<div class=\"schema-faq wp-block-yoast-faq-block\"><div class=\"schema-faq-section\" id=\"faq-question-1767613676844\"><strong class=\"schema-faq-question\"><strong>What&#8217;s\u00a0the difference between protecting a folder versus a single file?<\/strong>\u00a0<\/strong> <p class=\"schema-faq-answer\">Protecting a folder applies password requirements to all contents within that directory. To protect just one file, you must manually edit .htaccess\u00a0and wrap authentication rules in tags targeting that specific filename.\u00a0<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1767613686212\"><strong class=\"schema-faq-question\"><strong>Where is the .htpasswd\u00a0file\u00a0located?<\/strong>\u00a0<\/strong> <p class=\"schema-faq-answer\">The .htpasswd\u00a0file is stored outside your public directory for security, typically at\u00a0\/home\/[username]\/.htpasswds\/public_html\/passwd. You can verify the exact path in the\u00a0AuthUserFile\u00a0line of your .htaccess\u00a0file.\u00a0<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1767613693504\"><strong class=\"schema-faq-question\"><strong>What causes a 500 error after editing .htaccess?<\/strong>\u00a0<\/strong> <p class=\"schema-faq-answer\">500 errors\u00a0indicate\u00a0syntax problems in your .htaccess\u00a0file. Common causes include missing closing tags\u00a0( or\u00a0), incorrect\u00a0AuthUserFile\u00a0paths\u00a0or\u00a0extra spaces. Restore your backup and carefully recheck your syntax.\u00a0<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1767613711475\"><strong class=\"schema-faq-question\"><strong>Does this work on WordPress sites?<\/strong>\u00a0<\/strong> <p class=\"schema-faq-answer\">Yes, .htaccess\u00a0password protection works perfectly on WordPress since most WordPress hosts use Apache servers. It provides an extra security layer before WordPress loads, ideal for protecting admin areas or staging sites.\u00a0<\/p> <\/div> <div class=\"schema-faq-section\" id=\"faq-question-1767613720332\"><strong class=\"schema-faq-question\"><strong>How do I change or remove passwords?<\/strong>\u00a0<\/strong> <p class=\"schema-faq-answer\">To change passwords, use Directory Privacy in cPanel to update credentials for existing users. To remove protection entirely, uncheck the protection\u00a0option\u00a0in cPanel or\u00a0delete\u00a0the authentication directives from your .htaccess\u00a0file.\u00a0<\/p> <\/div> <\/div>\n","protected":false},"excerpt":{"rendered":"<p>Password protect folders and files with .htaccess or Directory Privacy to block unauthorized access in minutes.<\/p>\n","protected":false},"author":142,"featured_media":262878,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_yoast_wpseo_title":".htaccess Password Folder & Directory Protection Tutorial","_yoast_wpseo_metadesc":"Password protect directory with .htaccess folder authentication. Step-by-step tutorial to secure website files, restrict visitors and control access effortlessly.","inline_featured_image":false,"footnotes":""},"categories":[3067,1345],"tags":[3330],"ppma_author":[886],"class_list":["post-247265","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-performance","category-website","tag-how-to-guides"],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO Premium plugin v27.1 (Yoast SEO v27.1.1) - https:\/\/yoast.com\/product\/yoast-seo-premium-wordpress\/ -->\n<title>.htaccess Password Folder &amp; Directory Protection Tutorial<\/title>\n<meta name=\"description\" content=\"Password protect directory with .htaccess folder authentication. Step-by-step tutorial to secure website files, restrict visitors and control access effortlessly.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/posts\/247265\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\".htaccess\u00a0Password\u00a0Folder &amp; Directory Protection Tutorial\u00a0\" \/>\n<meta property=\"og:description\" content=\"Password protect directory with .htaccess folder authentication. Step-by-step tutorial to secure website files, restrict visitors and control access effortlessly.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/\" \/>\n<meta property=\"og:site_name\" content=\"Bluehost Blog\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/bluehost\/\" \/>\n<meta property=\"article:published_time\" content=\"2026-01-05T11:52:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-02-10T04:52:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1100\" \/>\n\t<meta property=\"og:image:height\" content=\"600\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Vimal Sharma\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@bluehost\" \/>\n<meta name=\"twitter:site\" content=\"@bluehost\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Vimal Sharma\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/\"},\"author\":{\"name\":\"Vimal Sharma\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/#\/schema\/person\/9a7d0c023b06ccd7ca5b1e256c696ce0\"},\"headline\":\".htaccess\u00a0Password\u00a0Folder &amp; Directory Protection Tutorial\u00a0\",\"datePublished\":\"2026-01-05T11:52:59+00:00\",\"dateModified\":\"2026-02-10T04:52:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/\"},\"wordCount\":2824,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png\",\"keywords\":[\"How-To Guides\"],\"articleSection\":[\"Performance\",\"Website\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#respond\"]}]},{\"@type\":[\"WebPage\",\"FAQPage\"],\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/\",\"url\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/\",\"name\":\".htaccess Password Folder & Directory Protection Tutorial\",\"isPartOf\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png\",\"datePublished\":\"2026-01-05T11:52:59+00:00\",\"dateModified\":\"2026-02-10T04:52:41+00:00\",\"description\":\"Password protect directory with .htaccess folder authentication. Step-by-step tutorial to secure website files, restrict visitors and control access effortlessly.\",\"breadcrumb\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#breadcrumb\"},\"mainEntity\":[{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613676844\"},{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613686212\"},{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613693504\"},{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613711475\"},{\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613720332\"}],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#primaryimage\",\"url\":\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png\",\"contentUrl\":\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png\",\"width\":1100,\"height\":600,\"caption\":\"How to Password Protect a Folder cPanel\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.bluehost.com\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Website\",\"item\":\"https:\/\/www.bluehost.com\/blog\/category\/website\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\".htaccess\u00a0Password\u00a0Folder &amp; Directory Protection Tutorial\u00a0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/#website\",\"url\":\"https:\/\/www.bluehost.com\/blog\/\",\"name\":\"Bluehost\",\"description\":\"\",\"publisher\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.bluehost.com\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/#organization\",\"name\":\"Bluehost\",\"url\":\"https:\/\/www.bluehost.com\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2023\/08\/bluehost-logo.svg\",\"contentUrl\":\"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2023\/08\/bluehost-logo.svg\",\"width\":136,\"height\":24,\"caption\":\"Bluehost\"},\"image\":{\"@id\":\"https:\/\/www.bluehost.com\/blog\/#\/schema\/logo\/image\/\"},\"sameAs\":[\"https:\/\/www.facebook.com\/bluehost\/\",\"https:\/\/x.com\/bluehost\",\"https:\/\/www.linkedin.com\/company\/bluehost-com\/\",\"https:\/\/www.youtube.com\/user\/bluehost\",\"https:\/\/en.wikipedia.org\/wiki\/Bluehost\"],\"description\":\"Bluehost is a leading web hosting provider empowering millions of websites worldwide. \\u2028Discover how Bluehost's expertise, reliability, and innovation can help you achieve your online goals.\",\"telephone\":\"+1-888-401-4678\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/#\/schema\/person\/9a7d0c023b06ccd7ca5b1e256c696ce0\",\"name\":\"Vimal Sharma\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/#\/schema\/person\/image\/a5d47beff209e4747f9c46e20b528d70\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/4af986e0c3876d43bfcb0a4152b1d427d0aca4e3490bc0f8e369836d480df719?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/4af986e0c3876d43bfcb0a4152b1d427d0aca4e3490bc0f8e369836d480df719?s=96&d=mm&r=g\",\"caption\":\"Vimal Sharma\"},\"description\":\"With a background in content writing, I thrive on turning complex concepts into relatable content. I focus on delivering clarity and creativity to help our brands stand out in the crowded digital realm.\",\"url\":\"https:\/\/www.bluehost.com\/blog\/author\/vimal-sharma\/\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613676844\",\"position\":1,\"url\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613676844\",\"name\":\"What's\u00a0the difference between protecting a folder versus a single file?\u00a0\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Protecting a folder applies password requirements to all contents within that directory. To protect just one file, you must manually edit .htaccess\u00a0and wrap authentication rules in tags targeting that specific filename.\u00a0\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613686212\",\"position\":2,\"url\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613686212\",\"name\":\"Where is the .htpasswd\u00a0file\u00a0located?\u00a0\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"The .htpasswd\u00a0file is stored outside your public directory for security, typically at\u00a0\/home\/[username]\/.htpasswds\/public_html\/passwd. You can verify the exact path in the\u00a0AuthUserFile\u00a0line of your .htaccess\u00a0file.\u00a0\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613693504\",\"position\":3,\"url\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613693504\",\"name\":\"What causes a 500 error after editing .htaccess?\u00a0\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"500 errors\u00a0indicate\u00a0syntax problems in your .htaccess\u00a0file. Common causes include missing closing tags\u00a0( or\u00a0), incorrect\u00a0AuthUserFile\u00a0paths\u00a0or\u00a0extra spaces. Restore your backup and carefully recheck your syntax.\u00a0\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613711475\",\"position\":4,\"url\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613711475\",\"name\":\"Does this work on WordPress sites?\u00a0\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"Yes, .htaccess\u00a0password protection works perfectly on WordPress since most WordPress hosts use Apache servers. It provides an extra security layer before WordPress loads, ideal for protecting admin areas or staging sites.\u00a0\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"},{\"@type\":\"Question\",\"@id\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613720332\",\"position\":5,\"url\":\"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613720332\",\"name\":\"How do I change or remove passwords?\u00a0\",\"answerCount\":1,\"acceptedAnswer\":{\"@type\":\"Answer\",\"text\":\"To change passwords, use Directory Privacy in cPanel to update credentials for existing users. To remove protection entirely, uncheck the protection\u00a0option\u00a0in cPanel or\u00a0delete\u00a0the authentication directives from your .htaccess\u00a0file.\u00a0\",\"inLanguage\":\"en-US\"},\"inLanguage\":\"en-US\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":".htaccess Password Folder & Directory Protection Tutorial","description":"Password protect directory with .htaccess folder authentication. Step-by-step tutorial to secure website files, restrict visitors and control access effortlessly.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/posts\/247265\/","og_locale":"en_US","og_type":"article","og_title":".htaccess\u00a0Password\u00a0Folder &amp; Directory Protection Tutorial\u00a0","og_description":"Password protect directory with .htaccess folder authentication. Step-by-step tutorial to secure website files, restrict visitors and control access effortlessly.","og_url":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/","og_site_name":"Bluehost Blog","article_publisher":"https:\/\/www.facebook.com\/bluehost\/","article_published_time":"2026-01-05T11:52:59+00:00","article_modified_time":"2026-02-10T04:52:41+00:00","og_image":[{"width":1100,"height":600,"url":"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png","type":"image\/png"}],"author":"Vimal Sharma","twitter_card":"summary_large_image","twitter_creator":"@bluehost","twitter_site":"@bluehost","twitter_misc":{"Written by":"Vimal Sharma","Est. reading time":"13 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#article","isPartOf":{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/"},"author":{"name":"Vimal Sharma","@id":"https:\/\/www.bluehost.com\/blog\/#\/schema\/person\/9a7d0c023b06ccd7ca5b1e256c696ce0"},"headline":".htaccess\u00a0Password\u00a0Folder &amp; Directory Protection Tutorial\u00a0","datePublished":"2026-01-05T11:52:59+00:00","dateModified":"2026-02-10T04:52:41+00:00","mainEntityOfPage":{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/"},"wordCount":2824,"commentCount":0,"publisher":{"@id":"https:\/\/www.bluehost.com\/blog\/#organization"},"image":{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#primaryimage"},"thumbnailUrl":"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png","keywords":["How-To Guides"],"articleSection":["Performance","Website"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#respond"]}]},{"@type":["WebPage","FAQPage"],"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/","url":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/","name":".htaccess Password Folder & Directory Protection Tutorial","isPartOf":{"@id":"https:\/\/www.bluehost.com\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#primaryimage"},"image":{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#primaryimage"},"thumbnailUrl":"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png","datePublished":"2026-01-05T11:52:59+00:00","dateModified":"2026-02-10T04:52:41+00:00","description":"Password protect directory with .htaccess folder authentication. Step-by-step tutorial to secure website files, restrict visitors and control access effortlessly.","breadcrumb":{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#breadcrumb"},"mainEntity":[{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613676844"},{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613686212"},{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613693504"},{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613711475"},{"@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613720332"}],"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#primaryimage","url":"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png","contentUrl":"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2026\/01\/How-to-Password-Protect-a-Folder-or-File-in-cPanel.png","width":1100,"height":600,"caption":"How to Password Protect a Folder cPanel"},{"@type":"BreadcrumbList","@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.bluehost.com\/blog\/"},{"@type":"ListItem","position":2,"name":"Website","item":"https:\/\/www.bluehost.com\/blog\/category\/website\/"},{"@type":"ListItem","position":3,"name":".htaccess\u00a0Password\u00a0Folder &amp; Directory Protection Tutorial\u00a0"}]},{"@type":"WebSite","@id":"https:\/\/www.bluehost.com\/blog\/#website","url":"https:\/\/www.bluehost.com\/blog\/","name":"Bluehost","description":"","publisher":{"@id":"https:\/\/www.bluehost.com\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.bluehost.com\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.bluehost.com\/blog\/#organization","name":"Bluehost","url":"https:\/\/www.bluehost.com\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.bluehost.com\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2023\/08\/bluehost-logo.svg","contentUrl":"https:\/\/www.bluehost.com\/blog\/wp-content\/uploads\/2023\/08\/bluehost-logo.svg","width":136,"height":24,"caption":"Bluehost"},"image":{"@id":"https:\/\/www.bluehost.com\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/bluehost\/","https:\/\/x.com\/bluehost","https:\/\/www.linkedin.com\/company\/bluehost-com\/","https:\/\/www.youtube.com\/user\/bluehost","https:\/\/en.wikipedia.org\/wiki\/Bluehost"],"description":"Bluehost is a leading web hosting provider empowering millions of websites worldwide. \u2028Discover how Bluehost's expertise, reliability, and innovation can help you achieve your online goals.","telephone":"+1-888-401-4678"},{"@type":"Person","@id":"https:\/\/www.bluehost.com\/blog\/#\/schema\/person\/9a7d0c023b06ccd7ca5b1e256c696ce0","name":"Vimal Sharma","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.bluehost.com\/blog\/#\/schema\/person\/image\/a5d47beff209e4747f9c46e20b528d70","url":"https:\/\/secure.gravatar.com\/avatar\/4af986e0c3876d43bfcb0a4152b1d427d0aca4e3490bc0f8e369836d480df719?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/4af986e0c3876d43bfcb0a4152b1d427d0aca4e3490bc0f8e369836d480df719?s=96&d=mm&r=g","caption":"Vimal Sharma"},"description":"With a background in content writing, I thrive on turning complex concepts into relatable content. I focus on delivering clarity and creativity to help our brands stand out in the crowded digital realm.","url":"https:\/\/www.bluehost.com\/blog\/author\/vimal-sharma\/"},{"@type":"Question","@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613676844","position":1,"url":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613676844","name":"What's\u00a0the difference between protecting a folder versus a single file?\u00a0","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Protecting a folder applies password requirements to all contents within that directory. To protect just one file, you must manually edit .htaccess\u00a0and wrap authentication rules in tags targeting that specific filename.\u00a0","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613686212","position":2,"url":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613686212","name":"Where is the .htpasswd\u00a0file\u00a0located?\u00a0","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"The .htpasswd\u00a0file is stored outside your public directory for security, typically at\u00a0\/home\/[username]\/.htpasswds\/public_html\/passwd. You can verify the exact path in the\u00a0AuthUserFile\u00a0line of your .htaccess\u00a0file.\u00a0","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613693504","position":3,"url":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613693504","name":"What causes a 500 error after editing .htaccess?\u00a0","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"500 errors\u00a0indicate\u00a0syntax problems in your .htaccess\u00a0file. Common causes include missing closing tags\u00a0( or\u00a0), incorrect\u00a0AuthUserFile\u00a0paths\u00a0or\u00a0extra spaces. Restore your backup and carefully recheck your syntax.\u00a0","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613711475","position":4,"url":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613711475","name":"Does this work on WordPress sites?\u00a0","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"Yes, .htaccess\u00a0password protection works perfectly on WordPress since most WordPress hosts use Apache servers. It provides an extra security layer before WordPress loads, ideal for protecting admin areas or staging sites.\u00a0","inLanguage":"en-US"},"inLanguage":"en-US"},{"@type":"Question","@id":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613720332","position":5,"url":"https:\/\/www.bluehost.com\/blog\/password-protect-a-folder-on-your-website\/#faq-question-1767613720332","name":"How do I change or remove passwords?\u00a0","answerCount":1,"acceptedAnswer":{"@type":"Answer","text":"To change passwords, use Directory Privacy in cPanel to update credentials for existing users. To remove protection entirely, uncheck the protection\u00a0option\u00a0in cPanel or\u00a0delete\u00a0the authentication directives from your .htaccess\u00a0file.\u00a0","inLanguage":"en-US"},"inLanguage":"en-US"}]}},"authors":[{"term_id":886,"user_id":142,"is_guest":0,"slug":"vimal-sharma","display_name":"Vimal Sharma","avatar_url":"https:\/\/secure.gravatar.com\/avatar\/4af986e0c3876d43bfcb0a4152b1d427d0aca4e3490bc0f8e369836d480df719?s=96&d=mm&r=g","0":null,"1":"","2":"","3":"","4":"","5":"","6":"","7":"","8":"","9":"","10":"","11":"","12":"","13":"","14":"","15":""}],"_links":{"self":[{"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/posts\/247265","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/users\/142"}],"replies":[{"embeddable":true,"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/comments?post=247265"}],"version-history":[{"count":7,"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/posts\/247265\/revisions"}],"predecessor-version":[{"id":265356,"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/posts\/247265\/revisions\/265356"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/media\/262878"}],"wp:attachment":[{"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/media?parent=247265"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/categories?post=247265"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/tags?post=247265"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.bluehost.com\/blog\/wp-json\/wp\/v2\/ppma_author?post=247265"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}