cPanel Leech Protect: Stop Leaked Logins on Protected Folders

You password-protected a staging folder or client-proofing directory in cPanel months ago. Now you're seeing logins from IPs you don't recognize, or a client mentions their intern is using "the shared password everyone has." cPanel has a feature built exactly for this, and almost nobody turns it on: Leech Protect.

What Leech Protect Actually Does

Leech Protect doesn't create a new layer of security by itself. It sits on top of a directory you've already locked down with Directory Privacy (cPanel > Files > Directory Privacy, sometimes still labeled "Password Protect Directories"). Once a folder has at least one .htpasswd user, Leech Protect watches how often that username logs in successfully within a time window you set. Cross the threshold, and cPanel disables the account automatically - no manual intervention needed.

The logic is simple: a real person logs in once, maybe re-authenticates a couple of times a day across devices. Twenty successful logins from one username in two hours almost always means the password got forwarded in a Slack message, pasted into a shared doc, or brute-forced. Leech Protect can't tell you which - it just cuts access the moment the pattern looks wrong.

Symptom: The Directory Option Doesn't Show Up

The most common support ticket here isn't abuse - it's confusion about why Leech Protect won't let you select a folder at all. The cause is almost always the same:

• The directory has no Directory Privacy protection enabled yet, so there's no .htpasswd file for Leech Protect to attach to
• Directory Privacy is enabled, but zero users were ever created under it
• You're looking at the wrong account - Leech Protect is scoped per cPanel user, and addon domains sometimes trip people up here

Leech Protect is an add-on, not a replacement. Set up Directory Privacy and create at least one username/password first, then Leech Protect will list that path as an option.

Fix: Enable Directory Privacy First

1. cPanel > Files > Directory Privacy
2. Navigate to the folder you want to protect and toggle Password protect this directory
3. Under Create User, add a username and a strong password - give each real person their own login rather than one shared account (more on why below)
4. Save, then go to cPanel > Security > Leech Protect
5. The directory should now appear in the list

Symptom: Legitimate Users Keep Getting Locked Out

You enable Leech Protect, set a threshold, and within a day your own team can't get in. This is almost never a bug - it's a mismatch between how the account is structured and how the feature actually counts logins.

Cause: One Shared Username, Multiple People

Leech Protect counts successful authentications per username, not per IP or per device. If three people on your team all log in as staging_user, from laptops, phones, and a CI script that re-authenticates on every deploy, that one username can blow past a threshold of 4 logins/2 hours by lunchtime - even though nothing was actually leaked.

Fix: Give Every Person Their Own Login

Go back to Directory Privacy and create a separate username for each person or system that needs access. This does two things: it stops false positives from tripping the whole team's access, and it means that if one credential does get leaked, only that person's login gets disabled - everyone else keeps working.

Choosing a Sane Threshold

There's no universal right number, but a few starting points that work for most setups:

• Client proofing / occasional-access folders: 4 logins per 2 hours is generous enough for someone reviewing files across a couple of devices without opening the door to obvious sharing
• Internal dashboards checked constantly during the day: raise it to something like 20 logins per 4 hours, or Leech Protect will fight your own team all day
• Anything hit by an automated script (a monitoring check, a CI pipeline): exclude it from Directory Privacy entirely, or give the script its own dedicated username with a high threshold, since machine logins don't behave like human ones

What Happens When Leech Protect Trips

When the login count crosses your limit, cPanel edits the .htpasswd entry for that username - effectively scrambling it so the existing password no longer authenticates. The user gets a 401 on their next attempt, same as a wrong password. There's no email alert by default and no countdown; it's just off until you fix it.

Fix: Recovering a Disabled Account

1. cPanel > Files > Directory Privacy
2. Open the protected directory and find the disabled user
3. Set a new password for that username (don't reuse the old one if you suspect it leaked)
4. Share the new credential only with the person who's actually supposed to have it - not the group chat it came from last time

Leech Protect Is Not Brute-Force Protection

This trips people up: Leech Protect counts successful logins, not failed ones. A bot hammering the Basic Auth prompt with wrong passwords won't trigger it at all - it'll just get 401s until it succeeds or gives up. If you're worried about someone guessing weak .htpasswd credentials outright, that's a separate problem:

• Use a genuinely random password for each Directory Privacy user, not something guessable
• Pair the directory with an IP allow-list in .htaccess (Require ip x.x.x.x on Apache 2.4) if access only ever comes from known locations
• Watch your Apache error log for repeated 401s against that path - a burst of them from one IP is your brute-force signal, and something like fail2ban can act on it at the server level

Prevention Checklist

• Never share one Directory Privacy username across a team - one login per person, always
• Set the login threshold based on how the folder is actually used, not a default guess
• Rotate credentials on long-lived protected folders every few months, especially after someone leaves the project
• Combine Leech Protect with an IP allow-list for anything sensitive - it catches the abuse pattern Leech Protect structurally can't (a leaked credential used from a single, patient IP)
• Check back periodically for disabled accounts sitting unfixed - a locked-out real user often just assumes the site is broken and stops trying, rather than filing a ticket

Leech Protect is a small feature, but for anything that gets a Basic Auth password handed to more than one person, it's one of the few things in cPanel that catches credential sharing automatically, without you having to comb through logs.