Directory privacy and hotlink protection

Directory Privacy puts a simple username and password prompt on one folder of your site. Hotlink protection stops other websites from embedding your images directly. Both tools live in cPanel under Security, and they solve different problems.

How Directory Privacy works

Directory Privacy is HTTP basic authentication on a path you choose. It is not a membership plugin and it does not create cPanel logins. The users you add there only unlock that folder. Many customers use it on a staging subdomain so a redesign stays private until launch. Pair the password gate with a noindex tag so search engines do not index the work in progress.

Avoid locking production paths that apps or plugins need open. Basic auth on /wp-json will break a WordPress mobile app. Do not protect wp-admin on a live site and then forget the credentials later. If File Manager’s path and the public URL disagree, check the tree over SSH or Terminal so you know exactly which folder you gated.

• Staging: Directory Privacy, noindex, and a subdomain work well together.
• Production APIs: leave them open if apps or headless clients must reach them.
• Credentials: store them somewhere your team can find; they are separate from cPanel users.

Hotlink protection and related tools

Hotlink protection checks the referrer and blocks other sites from loading your images as if they were their own. Add your own HTTPS hostnames to the allowlist so your pages still display media. Blocking blank referrers can break email clients and privacy-minded browsers, so leave that option off unless you have a clear reason. If you use a CDN, allow its hostnames too or images will fail after you enable the feature.

Hotlink protection is not a bandwidth plan. It only reduces casual image embedding. Leech protection is an older control; signed URLs at the application layer are usually a better fit today. The IP Blocker is fine for a short, targeted block. A real flood belongs in a support ticket rather than a long list of networks in the panel.

• Images: allowlist your site names and any CDN hostnames you use.
• Blank referrers: keep them allowed unless you accept broken clients.
• Heavy abuse: open a ticket instead of managing large IP lists alone.

Practical setup checklist

For a private staging site, enable Directory Privacy on that document root, set a strong password, and add noindex. Confirm the prompt appears in a private browser window. For images on production, turn on hotlink protection only after your own domains and CDN names are listed. Test a page load and an external embed attempt so you know the rules behave as expected.

On shared hosting you manage these options in cPanel without root access. AutoSSL can still issue certificates for the hostname while Directory Privacy is active. If something still looks wrong after you save, clear any CDN cache for that host and retest before changing more settings.