Enable or Disable HTTP Authentication

Updated: 11 October 2026 · Applies to: Apache 2.4 (.htaccess)

HTTP authentication asks visitors for a username and password before they can open a folder of your website. It is a simple way to protect an admin area, a staging site or private downloads.

Turn it on in cPanel

1. Log in to cPanel (for example at https://yourdomain.com:2083, or from the Ucartz client area).
2. Open Files › Directory Privacy.
3. Click Edit next to the folder you want to protect (click a folder name to go deeper).
4. Tick Password protect this directory, enter a name for the protected area and click Save.
5. Click Go Back, then under Create User enter a username and password and click Save.

Turn it off

Open the same folder in Files › Directory Privacy, untick Password protect this directory and click Save. You can delete individual users under Authorized Users.

Note: Basic authentication sends the password with every request, so only use it on sites served over HTTPS.

Without cPanel (Apache)

Create a password file outside the web root and point an .htaccess file at it:

htpasswd -c /home/user/.htpasswds/admin admin

# .htaccess in the protected folder
AuthType Basic
AuthName "Restricted area"
AuthUserFile /home/user/.htpasswds/admin
Require valid-user