How to Fix a 401 Unauthorized Error on Your Website

A 401 Unauthorized error means the page or folder a visitor tried to open requires a username and password, and the server rejected the request because no valid login was provided. It's different from a 403 Forbidden error, which usually means access is blocked outright with no login option at all.

This error almost always comes from one of two places: a password-protected directory you (or someone with access to your account) set up on purpose, or a misconfigured .htaccess file left over from an old setup.

Common Causes

• A folder on your website has password protection enabled, and the visitor didn't enter credentials, or entered the wrong ones.
• An old or corrupted .htaccess file in the folder still contains authentication rules from a previous setup.
• A WordPress security plugin or maintenance tool left behind an authentication rule after being removed.
• Login credentials were changed or removed, but browsers or apps are still sending the old ones automatically.

How to Check and Fix It

Start by confirming whether you intentionally password-protected the folder the visitor is trying to reach. If you did, and you just forgot the credentials or need to remove protection, use your control panel's password protection tool.

In cPanel

1. Log in to cPanel and open Directory Privacy under the Files section.
2. Navigate to the folder that's showing the 401 error.
3. If protection is enabled and you no longer need it, untick Password protect this directory and click Save.
4. If you still need it, scroll down and either reset the existing user's password or create a new authorized user under that same screen.

In DirectAdmin

1. Log in to DirectAdmin and open Password Protected Directories under the Advanced Features section.
2. Browse to the folder in question.
3. Remove the checkmark next to the folder name to disable protection, or click into it to add or reset a user's password.
4. Click Save to apply the change.

If you didn't set up password protection and the error still appears, the cause is likely a leftover authentication rule in .htaccess.

1. Open the File Manager in your control panel and navigate to the affected folder.
2. Make sure hidden files are visible, since .htaccess starts with a dot.
3. Open .htaccess and look for lines starting with AuthType, AuthName, AuthUserFile, or Require valid-user. These lines are what trigger the login prompt.
4. If you don't recognize the rule or no longer need it, remove those lines and save the file.

Before editing .htaccess, download a copy or rename it (e.g. to .htaccess-backup) so you can restore it quickly if something else on the site depended on those rules.

If a specific visitor keeps getting a 401 error when everyone else can access the page fine, ask them to clear their browser cache or try an incognito/private window. Browsers sometimes keep sending old, saved credentials automatically, which can trigger a rejected login even after you've changed the password.

For more on setting up or managing protected folders on purpose, see How to Password-Protect a Directory on Your Website.