Protect Your Site with Directory Privacy, IP Blocker and Hotlink Protection

cPanel includes three simple tools that solve common security annoyances without plugins: Directory Privacy puts a username and password on a folder, IP Blocker stops specific visitors or bots from reaching your site, and Hotlink Protection prevents other websites from displaying your images using your bandwidth.

Directory Privacy: password-protect a folder

Use this for a staging copy, an admin area, private downloads or a site that is not ready yet. Visitors see a login box before anything loads.

1. Log in to your FimuroHost client area at https://app.fimurohost.com.
2. Go to Services and select your cPanel Hosting plan.
3. Click Login to cPanel. cPanel opens in a new tab, already signed in.
4. In the Files section, click Directory Privacy.
5. Browse to the folder by clicking folder names, then click Edit next to the one you want to protect (for example public_html/staging).
6. Tick Password protect this directory, enter a label in Enter a name for the protected directory (shown in the login box) and click Save.
7. Click Go Back. Under Create User, enter a Username and New Password (twice), then click Save.

Test it in a private browser window. To remove protection, untick the box and save. The login box is sent over HTTPS only when your site uses SSL, so make sure SSL is active first.

For WordPress: protecting wp-admin this way adds a second login, but can break some plugins that call admin-ajax.php. Test the site after enabling it.

IP Blocker: block a visitor or bot

1. First find the address to block. Metrics » Visitors or Raw Access show which IP addresses make the most requests.
2. Go to Security » IP Blocker.
3. In Add an IP or Range, enter one of:
   • a single address: 203.0.113.25
   • a range: 203.0.113.1-203.0.113.50
   • a CIDR block: 203.0.113.0/24
   • an IPv6 address
   • a domain name, which cPanel converts to its IP address
4. Click Add.

cPanel saves the block as rules in your .htaccess file, and blocked addresses get a 403 Forbidden error on your websites. It only blocks website access, not email or FTP. Remove a block in the Currently-Blocked IP Addresses table. Be careful not to block your own IP address, search engine crawlers or large mobile networks, where many people share addresses. For attacks from many addresses, open a ticket instead so we can help at server level.

Hotlink Protection: stop image theft

Hotlinking is when another site shows your images or videos directly from your server, using your bandwidth. To prevent it:

1. Go to Security » Hotlink Protection and click Enable.
2. Check URLs to Allow Access. It should list every version of your domains (http and https, with and without www). Add any other sites you trust, such as your own CDN address.
3. In Block direct access for the following extensions, keep image types like jpg,jpeg,gif,png,webp,avif and add others you need (for example mp4,pdf).
4. Leave Allow direct requests ticked so people can still open an image link directly or when their browser hides the referrer.
5. Optionally enter Redirect the request to the following URL, such as a small “image from yourdomain.com” picture.
6. Click Submit.

Hotlink Protection can break images in email newsletters, social media previews and apps that load your images. If that happens, add their domains to the allowed list or turn it off.

Other security basics

• Turn on two-factor authentication for cPanel and your client area.
• Keep WordPress, themes and plugins updated and delete unused ones.
• Take regular backups and keep a copy off the server.
• If your plan includes a security scanner such as Imunify360, check its reports in cPanel.

Need help?

If anything in this guide does not match what you see, or you get stuck, open a support ticket (choose the Support department) or message us on WhatsApp at 01818160926. Tell us your domain name and what you have tried so far, and never send your password in a ticket or chat.