Password-protect a folder

Written for: Customer, Reseller, Administrator

Sometimes there is something on your website that is not for everybody. The new site that is not finished. A folder of quotes for one client. The handbook only your staff should read. You can put such a folder behind a user name and a password: whoever types the address gets the browser's own login prompt first, and the page only after that.

It covers everything in the folder — pages, images, PDFs, downloads — and search engines too: Google cannot get in, so the contents never turn up in the results.

What it is not. This is not a safe. The password travels over a secure connection (https), but anybody who knows it can read the files. Do not put copies of passports or a whole customer database in there. For "not finished yet" and "this client only" it is exactly right.

In the panel

Open your account and go to Websites.
Click the website. A panel slides open.
Under Protected folders, click Manage protection.
Click Protect a folder.

There are four things to fill in:

Field	What you enter
Folder	click through to the folder you want to protect
Name of the area	the text the browser shows in its login prompt
Login name	the name the visitor logs in with
Password	leave this empty — the server makes one

You click your way to the folder, you do not type it

The box under Folder lists the folders of your website. Click one to open it, and use the arrow at the top left to go back up. The line at the top shows where you are.

Stay on The whole website and your entire site goes behind a password. That is what you want when a new site is not ready to be found yet.

Why click and not type? Because a typo says nothing. Protect /private while the folder is really called /privee and nothing is protected — and you find out when somebody calls about what they have just read.

You see the password once

Leave the password field empty and the server makes one of twenty characters. It then appears in a card at the top, with a Show password button and a button to copy it. Copy it straight away.

It is stored nowhere. We cannot show it again either. If you lose it, set a new password for the same login name — the visitor then uses the new one.

Hand the password over through something other than e-mail: call, message it, or put it in a password manager you share. A password in a mailbox stays there for years.

Giving somebody else access

A protected folder can have several login names. Useful when three people need the quotes folder, because you can then remove one of them later without giving the others a new password.

In the folder's card, click Add login, enter a name, leave the password empty again, and click Add login once more.

A login name may contain letters, digits, a dot, a dash and an underscore. It is not your panel login: it is a separate name that only applies to that folder.

Taking access away again

Click the bin next to the login name and confirm. That password stops working straight away — the others keep their access.

If nobody is left in the list you will see the label nobody can get in. The folder is still protected, but there is no longer anybody who can open it. That is sometimes exactly what you meant and sometimes a mistake, which is why it is spelled out.

Removing the protection

Click the bin at the top right of the folder's card. The panel asks whether you are sure and says what will happen: the folder becomes public immediately, and the login names and passwords of that folder are deleted.

From the command line

If you have SSH access, this works too:

# protect a folder and give it a login in one go
corectl domain protect add mycompany.com /private --realm "Internal documents" --user anna

[corecp] mycompany.com/private/ asks for a password
mycompany.com/private/ asks for a password
user:     anna
password: <20 characters, shown once>

Write it down now — it is not stored and cannot be shown again.

# add somebody (or replace somebody's password)
corectl domain protect grant mycompany.com /private bob

# see what is protected
corectl domain protect list mycompany.com

DOMAIN                           PATH                         REALM                    USERS
mycompany.com                    /private                     Internal documents       anna,bob

# take somebody's access away
corectl domain protect revoke mycompany.com /private bob

# remove the protection altogether
corectl domain protect remove mycompany.com /private

To protect the whole website, use / as the folder:

corectl domain protect add mycompany.com / --realm "Under construction" --user client

Your certificate keeps renewing: the part of your site Let's Encrypt visits always stays open.

Common questions

I use my own .htaccess. Does this break it? No. CoreCP writes nothing into your folders — no .htaccess, no .htpasswd, no file at all. Your own .htaccess stays exactly as it was and keeps working.

Where are the passwords kept, then? Hashed (bcrypt), in a directory outside your website that is not reachable over the internet. They live under your account, so they travel with your backup and move with your site to another server.

Does it survive the hosting switching web server? Yes, and it is built that way on purpose. The protection lives in your website's own settings, not in a file that only one kind of web server reads.

Does it work for PHP pages? Yes. Everything in the folder is behind it: ordinary files, images and scripts alike.

Can I protect a single file instead of a folder? No — it works per folder. Put the file in a folder of its own and protect that.