This guide describes how to install WordPress in a subdirectory, protect it with HTTP authentication, and generate a static site using the Simply Static plugin.
Install or move your WordPress site into a subdirectory of your web root (for example /wordpress).
Example path:
/home/sites/123456/web/wordpress
This guide uses wordpress as the subdirectory name. If you choose a different name, update all paths, URLs, and configuration examples accordingly.
.htaccessCreate or edit the .htaccess file inside the wordpress directory. Use the wordpress subfolder boilerplate followed by commands to setup HTTPAuthentication password access for this folder:
# BEGIN WordPress
RewriteEngine On
RewriteRule .* - [E=HTTP_AUTHORIZATION:%{HTTP:Authorization}]
RewriteBase /wordpress/
RewriteRule ^index\.php$ - [L]
RewriteCond %{REQUEST_FILENAME} !-f
RewriteCond %{REQUEST_FILENAME} !-d
RewriteRule . /wordpress/index.php [L]
# END WordPress
## HTTPAuthentication
AuthType Basic
AuthName "http authentication"
AuthUserFile /home/sites/123456/include/.htpasswd
Require valid-user
## END HTTPAuthentication
Create an encrypted password file for HTTP Basic Authentication outside the web root. Replace username with the username you want to use when accessing the Wordpress site.
htpasswd -B -c /home/sites/123456/include/.htpasswd username
Also add authentication rules to your Apache configuration (via May First control panel advanced settings):
<Location /wordpress>
AuthType Basic
AuthName "Restricted Access"
AuthUserFile /home/sites/123456/include/.htpasswd
Require valid-user
</Location>
This ensures the WordPress backend is protected even though the static site will be publicly accessible.
If this is an existing WordPress installation, update URLs to reflect the new /wordpress path.
Example:
wp search-replace https://www.example.org https://www.example.org/wordpress --report-changed-only
Inside the WordPress dashboard:
Local Directory/home/sites/123456/web
.htpasswdOpen Simply Static → Activity Log
Click “Push” to generate the static site
Monitor the log output: