In this guide, you will learn how to create a password-protected directory in Plesk, configure user credentials, test the authentication process, and troubleshoot common issues.<\/p>\n\n\n\n
What Is a Password-Protected Directory in Plesk?<\/h2>\n\n\n\n
A password-protected directory is a website folder that requires users to authenticate before accessing its contents.<\/p>\n\n\n\n
For example, if you have a directory named Common use cases include:<\/p>\n\n\n\n Plesk typically implements directory-level password protection through web server authentication, such as HTTP Basic Authentication.<\/p>\n\n\n\n Before configuring password protection, ensure that you have:<\/p>\n\n\n\n The exact menu names may vary depending on your Plesk version, hosting configuration, and user permissions.<\/p>\n\n\n\n For example:<\/p>\n\n\n\n https:\/\/example.com<\/a><\/p>\n\n\n\n Your hosting provider may supply a different URL or port for accessing Plesk.<\/p>\n\n\n\n If you cannot find this option, your hosting provider may have disabled it, or your account may not have sufficient permissions.<\/p>\n\n\n\n For example, you might protect a directory at:<\/p>\n\n\n\n https:\/\/example.com\/private<\/a><\/p>\n\n\n\n Depending on your Plesk interface, you may need to specify the directory path relative to the website document root.<\/p>\n\n\n\n Important:<\/strong> Select the correct directory. Protecting the document root or a parent directory may restrict access to more of your website than intended.<\/p>\n\n\n\n After creating the protected directory, you need to configure an authorized user.<\/p>\n\n\n\n Use a unique password that is not shared with your Plesk administrator account or other services.<\/p>\n\n\n\n You can create additional users if multiple people need access to the protected directory.<\/p>\n\n\n\n After saving the configuration, test it from your web browser.<\/p>\n\n\n\n If the directory contains an index file, the browser may display that page after successful authentication.<\/p>\n\n\n\n If you are already logged in or have cached credentials, use a private browser window to test the authentication process properly.<\/p>\n\n\n\n You can also test the protected URL using Depending on your web server configuration, you should normally receive an HTTP The command prompts you for the password rather than placing it directly in the command history.<\/p>\n\n\n\n A successful request should return an appropriate response, commonly Replace Security note:<\/strong> Use HTTPS when testing credentials. Avoid putting passwords directly in shell commands because they may be recorded in shell history or exposed through process information.<\/p>\n\n\n\n Plesk allows you to manage access to protected directories after the initial setup.<\/p>\n\n\n\n Depending on the available options, you can:<\/p>\n\n\n\n Review user access periodically, particularly when employees, developers, or contractors no longer need access to private resources.<\/p>\n\n\n\n If you want to make a directory publicly accessible again, follow these steps:<\/p>\n\n\n\n Be careful when removing protection from a directory that contains confidential information. Verify that the content is intended to be publicly accessible before making this change.<\/p>\n\n\n\n Possible causes:<\/strong><\/p>\n\n\n\n Solution:<\/strong> An HTTP Solution:<\/strong><\/p>\n\n\n\n A Solution:<\/strong> Some files or URLs may be served from a different directory, application, or virtual host.<\/p>\n\n\n\n Solution:<\/strong> The feature may be unavailable because of hosting-provider restrictions, user permissions, or differences in the Plesk interface.<\/p>\n\n\n\n Solution:<\/strong> Follow these recommendations when protecting directories in Plesk:<\/p>\n\n\n\n HTTP Basic Authentication is not a substitute for application-level authorization. It is also important to understand that password protection restricts HTTP access to the configured directory; it does not encrypt files stored on the server.<\/p>\n\n\n\n Creating a password-protected directory in Plesk is a simple way to restrict access to private website content without manually configuring web server authentication.<\/p>\n\n\n\n By navigating to Websites & Domains \u2192 Password-Protected Directories<\/strong>, creating a protected directory, and adding authorized users, you can secure selected website resources through the Plesk control panel.<\/p>\n\n\n\n Always test the configuration, use HTTPS, maintain strong passwords, and review access permissions regularly to help keep your website secure.<\/p>\n\n\n\n Recommended next step:<\/strong> Review your Plesk directory permissions and confirm that only the intended website content is protected.<\/p>\n\n\n\n Yes. If your Plesk account provides the Password-Protected Directories feature, you can configure directory protection directly through the control panel.<\/p>\n\n\n\n Yes. Plesk generally supports multiple authorized users for a protected directory, subject to the available configuration and permissions.<\/p>\n\n\n\n Yes. Directory-level authentication can work with HTTPS. Using HTTPS is strongly recommended because it encrypts the connection, including authentication credentials.<\/p>\n\n\n\n Yes, but proceed carefully. Protecting directories used by WordPress may prevent visitors, plugins, APIs, or administrative functions from working correctly. Test the configuration before applying it to a production website.<\/p>\n\n\n\n No. Password protection controls access through the web server. It does not encrypt files stored on disk. Use file encryption and appropriate server permissions when storage-level protection is required.<\/p>\n\n\n\n Open Websites & Domains \u2192 Password-Protected Directories<\/strong>, select the protected directory, and manage the associated user account. The exact controls depend on your Plesk version.<\/p>\n\n\n\n Looking for the right technology solution for your business? Our team of experts can help you with development, cloud, DevOps, design, and a wide range of other technology needs. Get in touch with our team here: Contact Page<\/a><\/p>\n\n\n\n <\/p>\n","protected":false},"excerpt":{"rendered":" Introduction Securing sensitive website directories is an important part of website administration. If your website contains private documents, internal reports, development files, or restricted content, you may want to prevent unauthorized users from accessing them. Plesk provides a built-in feature called Password-Protected Directories that allows website administrators to restrict access to specific directories using a ..<\/p>\nprivate<\/code>, visitors must enter valid login credentials before viewing its protected pages or files.<\/p>\n\n\n\n\n
Prerequisites<\/h2>\n\n\n\n
\n
Step 1: Log In to the Plesk Control Panel<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-13-105130.png\")
<\/figure>\n\n\n\nStep 2: Open Password-Protected Directories<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2026\/10\/image-9.png\")
<\/figure>\n\n\n\nStep 3: Create a Protected Directory<\/h2>\n\n\n\n
\n
Private Documents<\/code>.<\/li>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2026\/10\/image-10.png\")
<\/figure>\n\n\n\nStep 4: Create a User Account<\/h2>\n\n\n\n
\n
privateuser<\/code>.<\/li>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2026\/10\/Screenshot-2026-10-13-105611-1.png\")
<\/figure>\n\n\n\nStep 5: Test the Password Protection<\/h2>\n\n\n\n
\n
https:\/\/example.com\/private\/<\/code><\/li>\n\n\n\n![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2026\/10\/image-11.png\")
<\/figure>\n\n\n\nStep 6: Verify That the Protection Works<\/h2>\n\n\n\n
curl<\/code> from a terminal.<\/p>\n\n\n\nCheck access without credentials<\/h3>\n\n\n\n
curl -I https:\/\/example.com\/private\/<\/code><\/pre>\n\n\n\n401 Unauthorized<\/code> response when authentication is required.<\/p>\n\n\n\nTest access with valid credentials<\/h3>\n\n\n\n
curl -I -u privateuser https:\/\/example.com\/private\/<\/code><\/pre>\n\n\n\n200 OK<\/code>, although redirects and directory configuration can produce other valid status codes.<\/p>\n\n\n\nexample.com<\/code>, \/private\/<\/code>, and privateuser<\/code> with your actual domain, directory, and username.<\/p>\n\n\n\nStep 7: Manage Users and Directory Access<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2026\/10\/image-12.png\")
<\/figure>\n\n\n\nHow to Remove Password Protection<\/h2>\n\n\n\n
\n
![\"\"](\"https:\/\/pheonixsolutions.com\/knowledge-base\/wp-content\/uploads\/2026\/10\/image-13.png\")
<\/figure>\n\n\n\nCommon Problems and Troubleshooting<\/h2>\n\n\n\n
1. The Password Prompt Does Not Appear<\/h3>\n\n\n\n
\n
Verify the protected directory path in Plesk, check the exact URL, and test the page in a private browser window.<\/p>\n\n\n\n2. The Browser Returns HTTP 401 Unauthorized<\/h3>\n\n\n\n
401 Unauthorized<\/code> response generally indicates that authentication is required or that the supplied credentials were not accepted.<\/p>\n\n\n\n\n
3. The Browser Returns HTTP 403 Forbidden<\/h3>\n\n\n\n
403 Forbidden<\/code> response may indicate file permissions, web server access rules, or directory indexing restrictions.<\/p>\n\n\n\n
Check the directory permissions and web server configuration. Also verify that the directory contains an appropriate index file if directory listing is disabled.<\/p>\n\n\n\n4. Password Protection Works on One Page but Not Another<\/h3>\n\n\n\n
Check the actual document root and URL mapping in Plesk. Ensure that the files you want to restrict are inside the protected directory.<\/p>\n\n\n\n5. The Password-Protected Directories Option Is Missing<\/h3>\n\n\n\n
Check your subscription permissions or contact your hosting provider. If you administer the server, review the relevant Plesk configuration and web server support.<\/p>\n\n\n\nSecurity Best Practices<\/h2>\n\n\n\n
\n
Conclusion<\/h2>\n\n\n\n
Frequently Asked Questions (FAQs)<\/h2>\n\n\n\n
1. Can I password-protect a directory without using SSH?<\/h3>\n\n\n\n
2. Can I create multiple users for one protected directory?<\/h3>\n\n\n\n
3. Does password protection work with HTTPS?<\/h3>\n\n\n\n
4. Can I protect a WordPress directory using Plesk?<\/h3>\n\n\n\n
5. Does password protection encrypt my files?<\/h3>\n\n\n\n
6. How can I change the password for a protected directory?<\/h3>\n\n\n\n
Related Articles<\/h3>\n\n\n\n
\n
Talk to our experts.<\/h2>\n\n\n\n