Check that directory protection fits this task
Restrict the intended directory, then test both its index and a direct file URL in a session without saved credentials.
Protection applies to a path, so direct files and alternate hostnames may need separate checks. Confirm the actual hosting plan includes the directory-protection control and that you can edit the intended site. DirectAdmin lists this as a possible user feature; its presence in a product list does not show that it is enabled in your Novasean account. If you cannot see an authorised control, ask support for the available route instead of editing server configuration.
Identify the exact HTTPS hostname, folder and one harmless test file beneath it. Check whether the application also exposes the same content through a route, CDN, backup link or another hostname. Directory authentication protects only requests that pass through the rule. Keep confidential data outside the public web root or behind application access controls; a protected review folder is not a complete security boundary.
Preserve access and a recovery route
Before changing access, keep a copy of the previous directory setting and note the account owner who can reverse it. Choose a dedicated test credential that is not the DirectAdmin, mailbox or customer-account password. Share it privately only with the intended reviewer. Ensure the folder is served over valid HTTPS before entering a password: HTTP Basic authentication otherwise carries credentials in a form that needs transport protection. Do not place real confidential files in the folder until you have verified the restriction.
If the same directory serves active application assets, check whether restricting it would break the public site. Use a separate folder for the review instead. If the setting is controlled by a web developer or contracted operator, agree who will apply and remove it.
Protect only the intended directory
In the entitled account control, select the website and the exact directory, enable its offered password protection and create the review user according to the panel prompts. Read the displayed path before saving: a parent directory can cover more than the single folder you intended. Do not install unrelated server modules, create a global web-server rule or change permissions across the site to imitate this feature.
After saving, check the folder’s configured state in the same account view. If the panel rejects the operation or shows an unfamiliar target path, stop; retain the prior state and ask for help with the selected hostname, folder and visible error, without sending the password.
Test both anonymous and authorised requests
Open a fresh private browser session with no saved site authentication. Request the directory URL and then the direct URL of the harmless file. Each should require authentication or deny the unauthenticated request; with HTTP authentication a challenge commonly appears as status 401, while other authorised implementations may return a different denial. A page that merely hides navigation but serves the direct file is not protected. Repeat for relevant hostname variants and through any cache or proxy path used by visitors.
In a separate authorised session, enter the review credential over HTTPS and confirm the intended file loads. Test an ordinary public page to ensure it remains public. Browser authentication may be cached for a session, so do not treat a previously signed-in browser as an anonymous test. Never paste credentials into a URL or a support ticket.
For example, a directory index may ask for a password while a direct PDF remains public. Test both without saved credentials and check whether a CDN or alternate hostname can still expose the file.
Correct a missed file or accidental restriction
If the direct file remains public, do not upload private material. Check whether it is really below the selected directory in the effective document root, and whether another hostname, application route or cache serves it outside the rule. Ask the application owner or host to inspect the actual request path when account-level evidence is insufficient. If public pages become restricted, restore the saved previous directory setting and retest both the review file and the affected public page.
When the review ends, remove or rotate the temporary access as agreed and verify that no confidential copy remains public. For ongoing private material, use an access design that covers every relevant route and file.
Frequently asked questions
Does a login prompt prove every file is protected? No. Test a direct file URL and any alternate route or hostname that serves the same content.
Why does my browser still open it without asking? It may remember authentication. Use a fresh private session and a separate device or authorised HTTP check if needed.
Should I change file permissions to 000? No. That can break the site without establishing the intended authenticated access. Use the account’s supported control or ask the operator.
Sources and technical references
Related guides
Was this guide helpful?
If you accepted optional analytics, your Yes/No answer and this guide’s page address are sent to Google Analytics. No written feedback is collected. Read our privacy statement or change your choice in .
Need help with your service?
Open your client area or contact Novasean. Describe the symptom and checks you have performed. Keep passwords, recovery codes and private keys out of your message.