Directory Privacy: Unexpected Public Access Despite AuthConfig

Goal

Confirm that a folder protected via cPanel’s Directory Privacy remains inaccessible to unauthenticated visitors.

Constraints

The protection is implemented through an .htaccess file containing AuthType Basic, AuthUserFile, and AuthName directives. File permissions must not be world‑readable and the parent directory should not be set to 777. The Index Manager may override visibility if “No Indexing” is selected.

Uncertainty

When the .htaccess file is present, some clients still view the directory contents without prompting. This can happen if the file is malformed, the directives are overridden by a higher‑level .htaccess, or the permissions on the folder are too permissive.

Questions

• What conditions cause cPanel to ignore the Directory Privacy .htaccess directives and allow public listing?
• How can we verify that the .htaccess file is correctly parsed by Apache when placed in a subdirectory?
• Is there a cPanel setting that automatically removes the AuthUserFile directive if the parent directory is set to “No Indexing”?