How to Password Protect the WordPress wp-admin Directory in cPanel

Bots try WordPress logins around the clock. Putting a second password in front of the wp-admin folder means a visitor has to get past the web server before WordPress even shows its login form. This guide shows how to do it with cPanel's Directory Privacy tool, the one exception you must add so your site's front end keeps working, and how to extend the same lock to wp-login.php.

1. What this protects, and what it does not

Directory Privacy uses HTTP basic authentication. The browser shows a small username and password box, and the web server checks it before any WordPress code runs. Bots that hammer /wp-admin/ get a 401 error instead of your dashboard, and they use far less of your account's resources doing it.

Three limits to know before you start:

• wp-login.php is not inside wp-admin. It sits in your WordPress root folder, and it is what most password-guessing bots actually attack. Section 5 shows how to put the same lock in front of it.
• It is a second lock, not a replacement. A strong, unique WordPress password with two-factor authentication is still the main control. See installing Wordfence and setting up two-factor authentication.
• It does not suit sites where visitors log in. Membership sites, forums, learning platforms and shops that use the standard WordPress login would put your customers in front of a password box they cannot pass.

2. Before you start

3. Protect wp-admin with Directory Privacy

cPanel writes the rules into wp-admin/.htaccess and stores the password file outside your website folder, at /home/USERNAME/.htpasswds/public_html/wp-admin/passwd. You need that path in section 5.

4. Keep admin-ajax.php open (do not skip this)

Many themes and plugins send requests from the public site to /wp-admin/admin-ajax.php: contact forms, add-to-cart buttons, live search, "load more" buttons, cookie banners. Once wp-admin is protected, every visitor who triggers one of those gets a password box or a silent failure.

Open public_html/wp-admin/.htaccess in the File Manager's editor and add this at the end:

# Let the public site use admin-ajax.php
<Files "admin-ajax.php">
    Require all granted
</Files>

# Show the real 401 response instead of a WordPress page
ErrorDocument 401 default

The first block exempts one file from the password. The second stops WordPress from answering the 401 error with its own page, which can otherwise show a "page not found" or loop instead of the login box.

If a front-end feature still asks for a password, open your browser's developer tools, look at the Network tab for the /wp-admin/ file that returned 401 (often admin-post.php), and add a matching Files block for it.

5. Also protect wp-login.php

Protecting wp-admin leaves the login form itself open. To put the same password in front of it, add this to the .htaccess in your WordPress root folder, above the # BEGIN WordPress line:

<Files "wp-login.php">
    AuthType Basic
    AuthName "Admin area"
    AuthUserFile "/home/USERNAME/.htpasswds/public_html/wp-admin/passwd"
    Require valid-user
</Files>

Replace USERNAME with your cPanel username, and adjust the folder part of the path if WordPress is not in public_html. It reuses the users you created in Directory Privacy, so there is one list to manage.

Skip this step if customers or members log in, register or reset their passwords through wp-login.php.

6. Test it properly

The browser may ask twice if you switch between http and https, or between www and the bare domain, because it remembers the password per address. Always use one address; see how to redirect non-www to www.

7. If something goes wrong

On our cPanel server, the firewall is configured to block an IP address for an hour after 10 failed logins to password-protected folders (measured 23 September 2026). That stops bots, and it can also stop you if you mistype repeatedly. If you are locked out, open a ticket from another connection, such as mobile data, and include your IP address.

To remove the protection, open Directory Privacy, click Edit next to wp-admin, untick the box and save. Delete any wp-login.php block you added to the root .htaccess as well.

8. Where this fits in WordPress security

This lock cuts noise and brute-force load. It does not fix an outdated plugin, which is still the most common way WordPress sites are hacked. Pair it with the basics in useful tips to secure WordPress from hackers, and read why and how WordPress websites get hacked for the routes attackers really use.

On Domain India's cPanel server, Imunify360's WordPress protection and web application firewall are already on for every account, measured on 20 September 2026. Directory Privacy adds a lock you control on top.

DirectAdmin and Webuzo also offer password-protected directories from their panels; the admin-ajax.php rule in section 4 applies there too. For password-protecting folders other than WordPress, see can I password protect directories.

The plan card shows the Domain India list price on 19 September 2026, excluding 18% GST.

Frequently asked questions

Ready to lock it down? Log in to cPanel from the client area, follow the steps above, then work through useful tips to secure WordPress. If you lock yourself out or a rule breaks the site, open a support ticket.