Skip to main content
.com domains from $2.99 — free WHOIS privacy on every name

Access control · Beginner · 5 minutes

How to password protect a folder — Directory Privacy: A 401 Before PHP Ever Starts

You want a staging build off-limits, and locking the wrong directory will take admin-ajax down with the rest of it.

View Secure Hosting plansBrowse more How-To Library

The short answer

Directory Privacy writes an .htaccess directive and a credentials file, and the web server then challenges every request for that path with a 401 before any application code runs. Nothing in PHP, WordPress or your framework is involved in the decision.

That is both the strength and the trap. It covers the entire subtree including direct file requests, and it costs almost no CPU because the request never reaches the interpreter — but it does not know which of those files your application needs to serve to logged-out visitors, which is exactly how protecting wp-admin breaks a site.

By the HostingFast team · Reviewed 24 August 2026

Beginner

Difficulty grade

5 minutes

Time budget

5

Stages

24/7

Engineer cover

Five minutes, one panel screen, fully reversible. It assumes you can open cPanel and choose a directory.

The WordPress section matters more than the configuration does, because the failure mode there is a site that appears to work until a form or a filter stops responding.

What the server does with a protected path

cPanel writes AuthType Basic, AuthName and a reference to an .htpasswd file into the directory's .htaccess, and stores the credentials outside the document root. From then on the web server answers with 401 and a WWW-Authenticate header until valid credentials arrive.

Because that decision is made by the server, it applies to everything beneath the path: nested folders, images, direct file URLs, anything. It also happens before PHP is started, which means a protected staging directory sheds crawler and bot traffic at almost no processing cost — a genuinely useful side effect on a busy account.

401 is not 403, and crawlers respect the difference

A 403 says the server refuses; a 401 says the server needs credentials and names the challenge. Browsers respond to the second with a login dialogue, and search engine crawlers respond by not indexing what they cannot fetch.

That is why protection is an effective way to keep a preview out of search results — and why protection left on after launch makes pages fade out of the index over the following weeks with no error anywhere to explain it.

Where it breaks WordPress

wp-admin is the obvious directory to protect and the wrong one. admin-ajax.php lives there and is served to logged-out visitors: contact forms, filtered product listings, cart updates and plenty of plugins all call it. Protect the directory and those requests get a 401 the front end cannot handle.

Better targets: wp-login.php as a single protected file, or the document root of a staging site. If wp-admin genuinely has to be protected, add an explicit exception allowing admin-ajax.php and then test the forms, because that is the part that fails quietly.

Verifying it, and taking it off deliberately

Check from a private window, because an existing session in your normal browser can mask the protection from the one person testing it. curl -I is better still: you want a 401 in the status line and a WWW-Authenticate header in the response.

Then diary the removal. The staging password still live on launch day is the textbook version of this failure, and it presents as a site that will not load for anybody except the person who set it up. Where a preview needs more than a shared password, staging environments are already on the plan.

The network filtering that soaks up attacks before they reach a site

The platform this was configured on

Every screen and header here was checked on the stack we operate: cPanel Directory Privacy, LiteSpeed serving the challenge, the same .htaccess handling. The behaviour described is your account's behaviour.

The rate you sign up at is the rate you renew at, so year two costs exactly what year one did with nothing waiting in the invoice.

  • Rejected before PHP starts
  • 401 verified with curl, not guessed
  • The WordPress exception named
  • Engineers on shift at any hour

Why HostingFast

Standard on every plan

A 401 before PHP starts

The web server rejects the request before any application code runs, which is both the security and the cost story.

401 against 403

Two status codes with two meanings, and crawlers treat them differently — which is the whole indexing consequence.

The whole subtree covered

Nested folders and direct file requests, not only the paths your application happens to route.

The WordPress exception

admin-ajax lives under wp-admin and is served to logged-out visitors, which is precisely what breaks.

Bot load shed cheaply

A protected staging path turns crawler traffic away without starting the interpreter at all.

Removal diarised

The staging password still live on launch day is the textbook failure, so the removal gets a date.

Quick Start

From order to online

  1. 1

    Choose the directory deliberately

    A staging document root, or a single file like wp-login.php. wp-admin is the tempting answer and the one that breaks front-end AJAX.

  2. 2

    Enable protection and name the realm

    cPanel, Directory Privacy, the folder, then a name for the prompt. The realm text is what the browser dialogue shows, so make it recognisable.

  3. 3

    Add one credential per person or purpose

    Separate logins mean you can revoke one without disturbing the others, and they share nothing with any other account you hold.

  4. 4

    Verify with a private window and with curl -I

    You want a 401 status and a WWW-Authenticate header. A live session in your usual browser will hide the protection from you.

  5. 5

    Test the application, then diary the removal

    Submit a form and load a filtered page before declaring it done, and put the removal date in the calendar the same day you set it up.

Built In

Loaded onto every plan

  • Staging environments for testing before anything ships
  • LiteSpeed caching in the server itself, not bolted on by plugin
  • DDoS filtering absorbed at the network edge
  • cPanel — the panel most of the industry already automates against
  • NVMe SSD storage on every tier, not just the expensive ones
  • Daily backups with restores you trigger yourself from the panel
  • Migration handled by our engineers at no charge
  • Engineers on shift every hour of every day, not a queue that opens at nine
  • No setup fee on any plan, ever
  • 99.9% uptime as the target, monitored around the clock

Frequently Asked

What people ask us most often

Does basic auth stop the request before PHP runs?

Yes. The web server evaluates the .htaccess directive and answers 401 without starting the interpreter, so a protected path costs a fraction of what a normal request does. That is why it is an effective way to keep crawler and bot traffic off a staging build as well as a way to keep humans out.

Can I protect wp-admin without breaking the site?

Only with an exception. admin-ajax.php sits inside wp-admin and is called by logged-out visitors for forms, filters and carts, so a blanket rule returns 401 to your own front end. Allow admin-ajax.php explicitly, or protect wp-login.php instead, and then submit a form to confirm it still works.

What does moving up a tier actually involve?

You upgrade in place. Plan changes happen from the client area with zero migration and zero downtime, and the range runs from compact shared accounts through VPS up to full dedicated servers. Growth becomes an account setting, not a hunt for a new host.

Is the included certificate genuinely free?

Completely, on every plan. The certificate issues as soon as your domain points at us and renews itself long before expiry. Encryption-wise it matches any paid DV certificate — the paid options exist only for wildcard coverage or organisation validation, which the vast majority of sites never touch.

Keep reading

Changing hosts? Run through our checklist first.

A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.

You'll get the checklist email, then occasional pointers on keeping a site running fast. Unsubscribe the moment you want out — the privacy policy covers the rest.

Gate it at the server.

Staging on the plan, LiteSpeed in the server itself, free SSL, and engineers on shift at any hour of the night.

View Secure Hosting plans