Confirm the domain uses supported hosting and that you can manage protected directories. Choose the exact relative path and use HTTPS so credentials are protected in transit. Check whether APIs, webhooks or certificate validation need an explicitly designed access path.

1. Open the domain Password-Protected Directories tool and add the intended directory.
2. Enter the directory path and a recognizable protection label. Use the root path only when you intend to protect the whole website.
3. Create a dedicated authentication user with a strong password. Do not reuse the Plesk owner or database credential.
4. Save and open the protected URL in a fresh private browser window. Test a file below the directory as well as the directory landing page.
5. Review alternate hostnames, HTTP and HTTPS access and direct static-file handling. Ensure the same private material is not exposed through a second domain or public storage URL.

Confirm unauthenticated access is denied and the authorized user can reach the expected page. Test an incorrect password once and verify it is rejected. Check that the website does not accidentally bypass protection for static downloads.

If the browser keeps signing in automatically, use a new private session because HTTP authentication can be cached. If nginx serves protected files directly, review the server request path with support. Do not rely on robots.txt or a noindex tag as access control. Remove temporary preview access and rotate shared passwords when the review period ends.

• Understanding nginx proxy mode and static files in Plesk
• Changing a Plesk website document root safely
• Creating a subdomain website in Plesk
• Protecting a Plesk account with two-factor authentication

• Plesk: Restricting Access To Content