Password-protected directories restrict access to specific folders on your website. Visitors must enter a username and password before they can view anything inside the protected folder. This is useful for client portals, staging areas, or private downloads.

## How to create a password-protected directory

1. Log in to **Plesk**.
2. Go to **Websites & Domains** and find your domain.
3. Click **Password-Protected Directories**.
4. Click **Add Protected Directory**.
5. In the **Directory name** field, type the path to the folder you want to protect (relative to your document root). For example: `private` to protect `httpdocs/private`.
   - To protect your entire website, enter `/`.
6. Optionally, enter a **Title of the protected area** — this is the message visitors see in the login prompt.
7. Click **OK**.

**Note:** On Plesk for Linux, the directory will be created automatically if it doesn’t exist yet.

## How to add users to the protected directory

A protected directory with no users means *nobody* can access it. You need to add at least one user:

1. In the **Password-Protected Directories** list, click the name of the directory you just protected.
2. Click **Add a User**.
3. Enter a **Username** and **Password**.
4. Click **OK**.

You can add multiple users if different people need access. Each user gets their own login credentials.

## How to test it

Open your browser and navigate to the protected URL (e.g. `https://yourdomain.com/private/`). You should see a login prompt asking for a username and password.

## How to remove password protection

1. Go to **Websites & Domains** > **Password-Protected Directories**.
2. Tick the checkbox next to the directory.
3. Click **Remove Protection**.
4. Confirm the removal.

The directory and its files will remain on the server — only the password protection is removed.

## Important notes

- Protecting a parent directory automatically protects all subdirectories beneath it.
- Don’t include `httpdocs` in the directory name — just enter the folder name relative to the document root.
- Password protection uses HTTP Basic Authentication (.htpasswd). It’s secure over HTTPS but credentials are sent in plain text over HTTP. Always use SSL on your domain.

## Troubleshooting

- **Login prompt doesn’t appear:** Clear your browser cache and try in an incognito window. If Apache restart intervals are configured on your server, protection may not take effect until the next restart.
- **“401 Unauthorized” even with correct credentials:** Remove the user and re-add them with a new password. Ensure there are no special characters in the password that may cause issues.
- **Want to change a user’s password?** Click the directory name, then click the username, and set a new password.