Knowledgebase

Directory Privacy adds a server-level password prompt in front of a folder. Placing it on wp-admin means attackers must get past Apache before WordPress even runs — an extremely effective block against brute-force bots.

Steps

1. In cPanel open Directory Privacy under Files.
2. Browse to public_html and click Edit next to the wp-admin folder.
3. Tick Password protect this directory, give it a name, and Save.
4. Go back and create a user with a strong password under Create User.

Required extra step

Protecting wp-admin also blocks admin-ajax.php, which the front end of many themes and plugins uses. This breaks contact forms, carts and filters for visitors. Prevent that by adding the following to public_html/wp-admin/.htaccess:

<Files admin-ajax.php>
Order allow,deny
Allow from all
Satisfy any
</Files>

What to expect

You will now be prompted twice when logging in: once by the browser for the server password, then by WordPress for your account. Keep both sets of credentials safe — losing the server password locks you out of the dashboard until you remove the protection from cPanel.