Leech Protection in cPanel: limit password sharing

Leech Protection helps detect excessive use of a username in a password-protected directory. It is designed for private areas where Basic Authentication credentials might be shared with too many people.

What Leech Protection does

When a user exceeds the login threshold you set, cPanel can redirect that user, disable the account, and send an alert. This is useful for private download sections, member-only folders, or temporary client portals protected by cPanel Directory Privacy.

Before enabling

• Create the protected directory with cPanel Directory Privacy.
• Decide how many logins per username are reasonable during a two-hour period.
• Create a redirect page explaining that access was limited.
• Confirm you have an email address ready for alerts.

Enable Leech Protection

1. Log in to cPanel.
2. Open Security and choose Leech Protection.
3. Select the password-protected directory.
4. Set the number of logins allowed per username.
5. Enter the redirect URL for suspected leeching.
6. Optionally enable email alerts or account disabling.
7. Click Enable.

Monitor results

Review alerts and access logs before permanently disabling users. A legitimate user can trigger the limit by switching networks, using multiple devices, or refreshing a download repeatedly.

Limitations

• Leech Protection applies to password-protected directories, not ordinary public pages.
• It is not a replacement for Hotlink Protection, Cloudflare, or application-level account controls.
• It does not protect files that are publicly accessible without Basic Authentication.
• If you need full membership controls, use your CMS, billing platform, or application permissions instead.

Related: Hotlink Protection in cPanel: stop external sites using your files | Raw access logs in cPanel: download and analyze website traffic | How to password protect a directory in cPanel | Advanced .htaccess in cPanel: redirects, PHP settings, and access rules

Related articles