Confirm the site uses a supported web server and directory-password setup. cPanel documents that LiteSpeed does not support this feature, so ask about an appropriate alternative on a LiteSpeed service.

1. Open Leech Protection, choose the correct document root and navigate to the password-protected directory.
2. Set a reasonable maximum login count for the feature’s two-hour window. Consider normal shared-office or automated access before choosing a restrictive threshold.
3. Configure a safe redirect destination and monitored alert address if needed. Review the effect of disabling accounts that exceed the threshold.
4. Enable the configuration and perform a controlled test with a dedicated directory user. Avoid testing against a critical shared production credential.
5. Review alerts and false positives, then adjust the threshold or response based on legitimate usage. Manage directory users through Directory Privacy.

The protected directory should still admit authorised normal use, while the configured excessive-activity response works in the supported environment. Keep an administrator recovery route available.

If legitimate users are blocked, inspect their usage and the configured response before raising every limit. If the web server does not support the feature, do not assume the visible icon makes it effective. Use application-specific protections for WordPress, client-area or other application logins.

It monitors the directory-authentication mechanism described by the feature. WordPress authentication is a separate layer and needs its own secure accounts, updates and supported login controls.

• Preventing unintended directory listings in cPanel
• Downloading raw access logs for an incident investigation
• Giving a colleague limited cPanel access with Manage Team
• Password-protecting a website folder with cPanel Directory Privacy

• cPanel: Leech Protection
• cPanel: Directory Privacy