If you use a password-protected directory on your website (for example a members area, a staging site, or a private downloads folder), you may worry about what happens once that password gets shared or leaked. Leech Protect is a security feature that watches for exactly this: it counts how many different logins happen against a protected directory in a set time window, and if the number looks like more people are using the password than you gave it to, it automatically disables the affected accounts.
What Leech Protection Does
Leech Protect only works on a directory that already has password protection turned on. Once enabled, it tracks logins to that directory over a time window you choose (for example, "more than 4 logins in 2 hours"). If that limit is crossed, it assumes the password has leaked and can automatically disable the compromised login, then optionally redirect anyone who tries to use it afterward to a page of your choosing.
Leech Protect is a detection and lockout tool, not a substitute for a strong password. Combine it with a long, unique password on the protected directory for the best protection.
In cPanel
- Log in to your cPanel account.
- In the Security section, click Leech Protect.
- From the list shown, select the password-protected directory you want to monitor.
- Set the number of logins allowed and the time period, for example 4 logins within 2 hours.
- Optionally, enter a Redirect the URL to address if you want blocked visitors sent somewhere specific, such as a page explaining their access was disabled.
- Click Enable to turn on monitoring for that directory.
Once enabled, cPanel disables the offending login automatically if the threshold is crossed. You can return to the same screen at any time to raise or lower the limit, or to turn protection off.
In DirectAdmin
DirectAdmin does not include a built-in Leech Protect equivalent that automatically counts logins and disables a compromised password. If you're on DirectAdmin and suspect a password-protected directory's credentials have been shared, the practical options are:
- Change the password on the protected directory immediately and share the new one only with people who still need access.
- Restrict access to the directory by IP address in addition to the password, if only a known set of visitors need to reach it.
- Check your website's access logs periodically for an unusual number of requests to the protected path, which can be a sign the password is being reused more widely than expected.
For help setting up the password protection itself, see How to Password-Protect a Directory on Your Website.