How to Password-Protect a Folder in ISPConfig

This guide shows you how to password-protect a folder inside your website using the ISPConfig control panel, so that visitors must enter a username and password before they can view anything in it. It is written for Noiz clients managing their own hosting account through ISPConfig. This kind of protection is sometimes called htaccess protection, basic authentication or a password-protected directory; in ISPConfig the feature is split across two screens, Protected Folders and Protected Folder Users, and this guide covers both. The panel does all the technical work for you: there is no need to create or edit any files by hand.

Last reviewed: 27 July 2026, against ISPConfig 3.3.1p1. This guide is written for Noiz hosting and is kept current against ISPConfig. It complements, and does not replace, the official ISPConfig documentation linked below.

Official Documentation Reference

• ISPConfig 3 User Manual: the official manual; folder protection is covered under Sites, in the Web Access sections "Protected Folders" and "Protected Folder Users".
• Sites module (ISPConfig 3 Documentation): the current official documentation for the Sites module.
• ISPConfig Documentation overview: the index of all official ISPConfig documentation.
• ISPConfig 3 source repository: the official source code, against which the current field and button labels in this guide were verified.

Prerequisites

• You can log in to the ISPConfig control panel.
• An existing website on your account. If you have not set one up yet, see How to Create a Website in ISPConfig.
• The path of the folder you want to protect, relative to the website's document root, for example /private. The folder does not have to exist yet: if it is missing, ISPConfig creates it for you.

How Folder Protection Works

ISPConfig protects folders with basic HTTP authentication, the same mechanism traditionally configured with .htaccess and .htpasswd files. Once protection is active, anyone who browses to the folder, or to any page or file inside it, sees a plain login prompt from their browser before the content loads. ISPConfig labels the protected area Members Only, so that is the name most browsers show in the prompt; it is fixed and not something you set. Only the usernames and passwords you create on the Protected Folder Users screen are accepted. These credentials are completely separate from your ISPConfig login and your FTP accounts.

Two records work together: a Protected Folder record defines which folder is locked, and one or more Protected Folder User records define who may enter. You need both, and the order matters. Creating the folder record on its own does not yet change anything on the server: ISPConfig writes the authentication files the first time you save a user for that folder. So the folder stays public until Step 2 is done, and you should treat the job as finished only once a user exists.

One security note before you start: basic authentication sends the username and password with every request in a lightly encoded, easily reversed form. Always use the protected area over HTTPS, so the credentials travel inside an encrypted connection.

Step 1: Create the Protected Folder

1. Log in to the ISPConfig control panel.
2. Click the Sites module in the top navigation.
3. In the left menu, under Web Access, click Protected Folders. A list of any existing protected folders on your account appears.
4. Click the Add new Folder button.

The Web Folder form opens on its Folder tab. It has just three fields, Website, Path and Active. Complete them as follows, then click Save.

Website

In the Website drop-down, select the website that contains the folder you want to protect, for example yourdomain.com. Any subdomain or alias domain that was created with its own vhost is listed here in its own right, so pick the entry whose document root actually holds the folder.

Path

In the Path field, enter the folder to protect, relative to the website's document root (the web directory where your site files live). Examples:

• /private protects the folder private in the document root, reached in a browser at https://yourdomain.com/private/.
• /files/secret protects the subfolder secret inside the folder files.
• / protects the entire website, which is handy for a staging or development site you do not want the public, or search engines, to see.

If the folder you enter does not exist yet, ISPConfig creates it automatically. Protection always covers everything inside the folder, including its subfolders. The field accepts letters, digits, dots, hyphens, underscores and slashes only, so a folder name containing a space cannot be protected this way; rename the folder first. A leading or trailing slash is optional, because ISPConfig trims them before it works out the real path.

Active

Leave the Active checkbox ticked. This is the master switch for the folder: unticking it later removes the protection without deleting the record or its users, and re-ticking it puts the protection back.

After you click Save, a small red change indicator appears near the top of the panel. Clicking it lists the changes that are not yet applied to the server, in this case Create folder protection, and the panel notes that storing updates can take up to a minute. Wait for it to clear before you judge the result. The folder is still public at this stage; the protection itself is put in place in Step 2.

Step 2: Create a Protected Folder User

Now create at least one username and password that will be accepted at the login prompt. This step is what actually switches the protection on: saving the first user is the point at which ISPConfig creates the folder if it is missing and writes the authentication files into it.

1. In the left menu of the Sites module, under Web Access, click Protected Folder Users.
2. Click the Add new Folder User button. The Web folder user form opens on its Folder tab.
3. In the Folder drop-down, select the protected folder you created in Step 1. Each entry reads as the website followed by the folder path, so you can tell similar paths apart. Every protected folder on your account is listed here whether or not it is ticked Active, so check the entry you pick is the one you want.
4. In the Username field, enter the username this person will type at the login prompt, for example reports. Use letters, digits, dots, hyphens and underscores only, up to 64 characters.
5. In the Password field, enter a strong password, or click the Generate Password button beside it to have ISPConfig create one for you. The Password strength bar rates your choice as you type. ISPConfig also enforces a minimum length and strength, and refuses to save a password it judges too weak, so generating one is the quickest way through. Note the password down now if it was generated, because it is stored as a one-way hash and ISPConfig cannot show it to you again.
6. Confirm the password in the Repeat Password field.
7. Leave the Active checkbox ticked, then click Save.

Repeat these steps for each person who needs access. Giving every person their own username and password means you can later remove one person's access without disturbing anyone else.

Step 3: Test the Protection

1. Wait until the red change indicator at the top of the panel has cleared.
2. Open a private (incognito) browser window. This matters because browsers remember basic authentication credentials, and a normal window may let you straight in from an earlier session.
3. Browse to the protected folder, for example https://yourdomain.com/private/. The browser should show a username and password prompt before any content appears.
4. Enter the username and password you created in Step 2. The folder's content should now load. If you cancel the prompt instead, the server returns an authorisation error page, which confirms the protection is working.

Once a visitor has signed in, the browser keeps sending the credentials automatically, so the prompt appears only once per browser session.

Managing and Removing Protection

• Change a password: go to Sites, then Protected Folder Users, click the username, enter a new password in the Password and Repeat Password fields and click Save.
• Remove one person's access: delete their record from the Protected Folder Users list, or untick their Active checkbox to suspend it temporarily.
• Move the protection to a different folder: edit the folder record and change the Path. ISPConfig moves the existing users across to the new folder, so nobody has to be recreated, and it clears the protection out of the old folder.
• Switch protection off temporarily: open the folder record under Protected Folders and untick Active. The folder becomes public again until you re-tick it; the users you created are kept.
• Remove protection permanently: delete the folder record from the Protected Folders list. Its Protected Folder Users are deleted along with it, so there is no need to tidy them up separately. Your files stay exactly where they are; only the password requirement is removed.

ISPConfig writes and maintains the authentication files for the protected folder itself. It marks its own work inside .htaccess with a pair of comment lines reading ### ISPConfig folder protection begin ### and ### ISPConfig folder protection end ###, and it rewrites everything between them whenever the record changes. Any rules of your own that sit outside those markers, such as redirects or caching directives, are left alone. So do not hand-edit the lines between the markers, because your changes will be replaced, and keep your own directives outside them.

Troubleshooting

• No password prompt appears: first check that the folder has at least one Protected Folder User, because a folder record on its own does not protect anything. If it does, the change may still be processing, so wait for the red change indicator to clear and try again. If it still fails, your browser may be replaying remembered credentials, so retest in a private window. Also check that the folder record is Active and that the Path matches the folder's real location relative to the document root, since a path that points at the wrong folder simply protects the wrong folder rather than reporting an error.
• The correct username and password are rejected: open the user record and confirm the Folder drop-down points at the right folder and the user is Active. Passwords are case sensitive, so retype the password in the Password and Repeat Password fields to be sure, save, and allow a minute for the change to apply.
• Everyone is locked out, including you: the folder is protected but has no user who is ticked Active. This happens most often after unticking Active on the last remaining user, or after re-saving the folder record while its users are all inactive: the prompt appears but no password is accepted. Create or reactivate a user under Protected Folder Users, or untick Active on the folder record until you are ready.
• The Folder drop-down is empty when creating a user: no protected folder exists on your account yet. Create and save one first (Step 1). Being ticked Active is not a condition for appearing in this list, so if the folder is missing from it the record was not saved.
• The prompt appears on a plain http address: the protection is working, but credentials typed over plain HTTP are easy to intercept. Share only the https:// address of the protected area with your users.

If you get stuck at any point, open a support ticket with the Noiz support team and include the website domain, the exact Path value you entered, the username that is failing (never include the password) and a note of what happens when you visit the folder in a private browser window.