GoAdmio
GoAdmio Documentation

Directory Privacy

From the GoAdmio knowledge base.

Directory Privacy

This page explains the Directory Privacy feature in GoAdmio. It lets you password-protect a directory on a website so that visitors must enter a username and password before they can view its contents.

Location: Admin Panel → Files & FTP → Directory Privacy
Location (User Panel): Files & FTP → Directory Privacy


Overview

Directory Privacy (sometimes called "Password Protect Directories" or "htpasswd protection") adds HTTP Basic Authentication to a folder on a website. When a visitor requests a file inside that folder, the web server asks for credentials before serving it.

This is useful for:

  • Staging sites — keep pre-launch versions private
  • Admin areas — add a second layer of protection in front of a CMS admin panel
  • Client-only content — restrict access to documents or media
  • Internal tools — protect dashboards and utilities that should not be public
  • Temporary lockdowns — block visitors during maintenance without taking the site offline
GoAdmio implements this via .htaccess (Apache) using mod_auth_basic and a .htpasswd file. On NGINX, GoAdmio writes the equivalent auth_basic configuration.

> Note: Directory Privacy protects a directory, not a single file. To protect a single file, place it in its own protected directory. Basic Auth is also sent over the wire in plaintext unless the site is served over HTTPS — always enable SSL before relying on it.


How It Works

When you protect a directory:

  1. GoAdmio creates a .htpasswd file containing the username and a hashed password (bcrypt or MD5 depending on the server configuration).
  2. It adds an .htaccess block to the directory that enables Basic Auth and points at the .htpasswd file.
  3. When a visitor requests any file inside the directory, the web server challenges them for credentials.
  4. On success, the file is served. On failure, the browser shows 401 Unauthorized.
> Warning: The .htpasswd file must not be publicly readable. Store it outside the web root, or protect it with a separate .htaccess deny rule. GoAdmio places it in a safe location by default, but verify if you customize the setup.

What the Page Shows

| Column / Field | Description |
|---|---|
| Directory | The directory being protected (relative to the site root) |
| Protection Status | Whether Basic Auth is enabled |
| Users | The usernames allowed to access the directory |
| Actions | Add user, remove user, unprotect directory |

> Tip: The page usually starts at the website's document root (www/example.com) and lets you drill into subdirectories. Only directories that exist can be selected.


How to Password-Protect a Directory

Via the Admin Panel

  1. Log in to the GoAdmio Admin Panel (or User Panel).
  2. Navigate to Files & FTP → Directory Privacy.
  3. Select the domain and then navigate to the directory you want to protect.
  4. Click Enable Protection (or Password Protect This Directory).
  5. Enter a label for the protected area (optional) — shown in the browser's login prompt.
  6. Click Save.
  7. Add at least one user:
- Enter a username. - Enter a password (twice). - Click Add User.

The directory is now protected. Visitors must enter the username and password to view its contents.

Via CLI / Manual .htaccess

For reference, GoAdmio creates something equivalent to:

.htaccess in the protected directory:

```apache
AuthType Basic
AuthName "Restricted Area"
AuthUserFile "/home/example/.htpasswd_protected"
Require valid-user

↑