How To Protect WordPress Folders On Your Server

Every month, thousands of WordPress websites get hacked. And most of these happen due to the ignorance and in some cases, negligence of the site owners. What’s more, the vast majority of site owners also forget to protect the important files and folders in their server. In this article, I will discuss the best ways of protecting your WordPress folders on the server.

Ways of Protecting Folders On Servers

There are two ways of protecting your folders on the server. They are –

• Using the ‘Security’ section of your cPanel or similar features of other hosting providers
• Creating .htaccess and .htpasswds files manually

Let’s discuss the cPanel method first.

Protecting Folders Via cPanel

In order to protect your folders through cPanel, first login to your cPanel dashboard. Go to the Security section. Click the “Directory Password” (or similar) option.

Choose “Web Root” in the resulting pop-up window. Click “Go&quot.

When the next screen loads, you will see a list of sub-directories. Among them, you want to protect the wp-admin folder. Select wp-admin folder from the list.

Make sure that the “Password protect this directory box” checkbox is checked. Provide a name for the directory in the next field. Click “Save” The name you choose for the directly doesn’t have to be actual name of the directory.

Next, you have to create a new username and password for accessing this folder in the future. You will find the “Create User” section below. Provide a user name and a strong password. Keep the username and password in a safe place for future reference. Now, click the “Add/Modify authorized user” button.

And you’re done From now on, your wp-admin folder will be locked down for ordinary visitors. Only the users you allow will be able to access the protected directories.

Protecting the Folders Manually

The second way to protect folders is via the .htaccess and the .htpasswd file on your server. You have to either do this manually or you can use tools like Dynamic Drive, which is what we use.

In short, our workflow will be like this:

1. Create a new .htpasswd file and upload it to a non-public area of your site – make not of the path to the .htpasswd file because you’ll need it in a minute
2. Create a new .htaccess file and upload it to the folder you want to protect

Now go to Dynamic Drive and enter the username and corresponding fields as instructed in step 1 on that page.

In step 2 you will put the path to the .htpasswd file you created earlier. In step 3 you will list the names of files you want to protect or if you enter nothing the entire folder will be protected.

When you click “Submit”, you’ll be given code to paste into your .htaccess and .htpasswd files. Paste it in and you’ve successfully protected your files and folders. Post that code into the appropriate files, upload them to your server again if you need to and you’re done.

File Uploading Tips

In case you need some pointers on uploading your .htaccess and .htpasswd files, here go you.

Upload the .htaccess file to the folder you want to protect. You can either use FTP or create the .htaccess file directly on your server via the file manager in your cPanel.

Next, we have to upload the .htpasswd file. Remember, you should upload this file to a non-public folder because it contains the username and the encrypted password. A non-public folder could be:

/home/USER/htpasswds/public_html/wp-admin/.htpasswd

In this example “USER” would be replaced with your cPanel username.

And you’re done.

That’s how you protect folders on the server. I know that was a bit technical, but its worth it. After all, you can’t leave your website security to chances, right? However, if you are still confused about any of these processes, please let me know. I will try my best to further clarify them for you.