Learning Hub · Beginner · 5 minutes
How to Password Protect a Folder
Everything you need to gate a directory behind hosting-level authentication — the steps, the gotcha, and the tip the support desk gives everyone.
The short answer
In one line: gate a directory behind hosting-level authentication — a beginner-level job taking 5 minutes.
Below: the exact steps, the classic pitfall, and a pro tip from the support desk. Where our platform automates a step, the guide says so rather than making you do robot work.
Beginner
Skill level
5
Steps to done
Free
Support included
Tested
On our platform
You don't need to be technical for this — the walkthrough is written for first-timers, tested against our own platform, and honest about which parts are genuinely fiddly versus merely unfamiliar.
Rule of the road: read the gotcha section before you begin, not after — it's harvested from the support tickets of people who didn't.
What you'll do, at a glance
Start to finish, you'll use directory privacy, create the access users, test from a private window, know what it covers and remove it deliberately.
None of the stages requires code or a terminal unless the guide explicitly says so — and where it does, the exact commands are given. The full step-by-step sits below; the surrounding sections cover the context that makes it stick.
Where this goes wrong (and how to not)
Password-protecting wp-admin and breaking AJAX — WordPress's admin-ajax lives there and serves logged-out visitors too; protect it only with the exceptions configured, or protect something else.
Forewarned is genuinely forearmed here — this exact mistake accounts for most of the frustration this topic produces, and it's entirely avoidable once named.
The pro tip worth stealing
Directory Privacy is the fastest way to hide a staging or preview site — one folder setting versus configuring privacy inside the application; clients get one credential to see work-in-progress.
It costs a minute now and repays it every time this task comes around again — which, like most hosting tasks, it will.
What's automated here
We've automated the steps that don't deserve your time: certificates issue and renew themselves, the installer handles application setup, daily backups cover the what-if, and per-site settings live in a panel instead of config files. The guide above covers what's left — the part that's actually about your site.
Stuck mid-task at an odd hour? That's what 24/7 human support is for — describe where you are in this guide and we'll take it from there.
The platform this guide assumes
Tutorials age badly when they're written against imaginary hosting. These are written against ours — the same panel, installer and defaults you'll actually see.
Every plan includes free SSL that renews itself, so the padlock is never your job.
- Step-by-step, tested as written
- The gotcha flagged before you hit it
- Automation covers the boring steps
- 24/7 support if you get stuck
Why HostingAlly
What you get with every plan
Automation where it belongs
SSL, backups and installs run themselves here — the guide covers only what's genuinely yours to do.
Help on standby
Stuck at step three at midnight? Support answers around the clock, mid-guide included.
No jargon tax
Terms are explained in place or linked to the glossary — nothing assumes you already know.
Written from real tickets
Our guides come from the support desk — the gotchas are the ones people actually hit.
Works as written
Every step tested on our own platform — no 'your host may vary' hand-waving.
The undo is always named
Where a step could bite, the guide says so and gives the reversal.
Getting Started
How to get going
- 1
Use Directory Privacy
cPanel → Directory Privacy → choose the folder → enable protection and name the prompt — the server now demands credentials before serving anything inside.
- 2
Create the access users
Add username/password pairs per person or per purpose — these are folder credentials, separate from every other login.
- 3
Test from a private window
The browser auth prompt should appear before any content — a logged-in session can mask the protection from your own view.
- 4
Know what it covers
Everything under the folder — files, subfolders, direct file URLs — at the server layer, before any application code runs.
- 5
Remove it deliberately
Protection outliving its purpose blocks legitimate visitors mysteriously — the staging password still active at launch is the classic.
Included
What's covered on our plans
- Renewal prices that match signup prices
- 99.9% uptime commitment, monitored around the clock
- DDoS protection at the network level
- Free website migration handled by our team
- 24/7 support from real people
- Email accounts on your own domain
- One-click installer for WordPress and 400+ apps
- SSH, Git and Composer access on developer-friendly plans
- No setup fees, ever
- NVMe SSD storage as standard
FAQ
Your questions, answered
How is this different from a WordPress password?
It's a layer earlier — the web server itself gates the folder before PHP executes at all. Application logins protect application routes; Directory Privacy protects everything physical under a path, including direct file access.
Can search engines see protected folders?
No — crawlers receive the same 401 challenge as everyone else, so protected content stays unindexed. It's also why forgotten protection makes pages 'vanish' from search over time.
What does your 24/7 support actually cover?
Real people at every hour, and a scope that includes the practical questions — email setup, DNS, WordPress issues, restores — not just 'the server is up, ticket closed'. Pre-sales questions are welcome too; ask us something difficult and judge the reply.
Will you move my existing website for free?
Yes — open a ticket with your current host's access details and we handle the whole move: files, databases, email and configuration, verified by you before DNS switches. The old site keeps serving until the new copy takes over, so visitors never see a gap.
Do prices go up at renewal?
No — the price you sign up at is the price you renew at. We don't run teaser-rate economics, so there's no year-two ambush to plan around, and your bookkeeping can rely on the number staying put.
Is SSL really included at no cost?
On every plan, with no exceptions — certificates are issued automatically when your domain points to us and renew themselves before expiry. The encryption is identical to paid DV certificates; paid tiers exist only for wildcard convenience or organisation-level validation.
Where is your company based?
HostingAlly is a trading name of Bohzo Ltd, a company registered in England and Wales — a real, verifiable business with published terms under English law, which is worth checking about any host before you hand them your domain.
Keep exploring
How to Take Payments Online
Choose and wire the payment stack that fits your selling — beginner level, an afternoon.
How to Build a Landing Page That Converts
One page, one job, measurably done — beginner level, an afternoon.
Domain Names
Search, register and transfer domains — first year free on annual hosting.
VPS Hosting
KVM virtual servers with root access, DDoS protection and flat pricing.
Your site deserves better hosting.
Every plan includes the essentials others sell as extras — and support that actually answers.
See Hosting Plans