Leech protection is a security feature that detects and blocks unusual login activity in password-protected directories. When enabled, it monitors how many times users log in within a two-hour period and automatically redirects or suspends accounts that exceed your set limit. This prevents credential sharing and protects your content from unauthorized mass distribution when login details get posted publicly or shared inappropriately.
By setting up leech protection through your hosting control panel, you can safeguard premium content, member areas, and restricted resources from abuse. The system gives you full control over login thresholds, redirect URLs, and email alerts when suspicious activity occurs.
How Leech Protection Safeguards Your Content
Leech protection works by tracking login attempts to password-protected directories. When someone tries to access a protected folder, the system logs their activity. If the same username logs in more times than your threshold allows within two hours, the protection activates automatically.
You can configure what happens when protection triggers. Options include redirecting users to a specific URL, sending email alerts to administrators, or completely disabling compromised accounts. This flexibility lets you balance security with user experience based on your specific needs.
Setting Up Leech Protection for Your Directories
To enable leech protection for a directory, start by accessing the Leech Protection interface in your control panel. Follow these steps:
- Click Settings and choose your starting location. You can select Web Root to begin in your primary domain's document root, or choose Document Root for and select a specific domain from the dropdown menu.
- If you want this directory to open automatically in future sessions, check the Always open this directory in the future option.
- Click Save Changes to confirm your selection.
- Navigate to the directory you want to protect by clicking folder icons or folder names until you reach the correct location.
- Enter the maximum number of logins you want to allow per user within a two-hour period. Choose a realistic number that accommodates legitimate use while blocking abuse.
- Optionally, enter a redirect URL where users who exceed the login limit will be sent. This could be an information page explaining your usage policy.
- To receive notifications, check Send Email Alert To and enter your email address. This helps you monitor when protection activates.
- If you want to automatically disable accounts that trigger protection, select Disable Compromised Accounts. Use this carefully as it prevents all access until you manually re-enable the account.
- Click Enable to activate leech protection for the selected directory.
Managing Users in Protected Directories
After enabling leech protection, you may need to manage user accounts for your protected directories. The system integrates with directory privacy settings to handle user authentication.
To manage users in a protected directory, navigate to the folder using the same method as when enabling protection. Once you've selected your directory, click Manage Users to access the directory privacy interface. From there, you can add new users with unique passwords, edit existing user credentials, or remove users who no longer need access.
OBHost's control panel makes it straightforward to maintain your user list and respond quickly when accounts become compromised. Regular user audits help ensure only authorized individuals retain access to protected content.
Best Practices for Effective Leech Protection
Setting appropriate login thresholds requires understanding your users' normal behavior. For most content, 5-10 logins per two hours works well for legitimate users while blocking credential sharing. Adjust higher for frequently accessed resources or lower for highly sensitive content.
Enable email alerts so you know immediately when protection triggers. This lets you investigate potential security issues and communicate with affected users. Review alert patterns regularly to identify whether thresholds need adjustment.
Consider using redirect URLs that explain your usage policy rather than showing generic error messages. This educates users about acceptable behavior and can prevent future violations. Combine leech protection with strong password requirements and regular credential rotation for maximum security.
Troubleshooting Common Leech Protection Issues
If legitimate users report being blocked, first verify your login threshold isn't too restrictive. Users accessing content from multiple devices or locations may trigger protection unintentionally. Increase the threshold slightly or communicate with users about best practices.
When protection doesn't activate despite suspicious activity, confirm you've enabled it for the correct directory and saved all settings. Check that the directory has password protection configured, as leech protection only works with authenticated access.
For accounts accidentally disabled by leech protection, you can re-enable them through the user management interface. Consider whether the threshold needs adjustment to prevent legitimate users from experiencing similar issues.
Frequently Asked Questions
What happens when someone exceeds the login limit?
When a user exceeds your configured login limit within two hours, they either get redirected to your specified URL or have their account suspended, depending on your settings. If you enabled email alerts, you'll receive notification of the event. The user cannot access the protected directory again until the two-hour window expires or you manually re-enable their account.
Can I use leech protection on multiple directories simultaneously?
Yes, you can enable leech protection on as many directories as needed. Each directory maintains independent settings, so you can configure different login thresholds and behaviors based on the sensitivity of different content areas. Simply repeat the setup process for each directory you want to protect.
Does leech protection work with all types of content?
Leech protection works with any content in password-protected directories, including HTML pages, images, videos, downloadable files, and more. However, it only monitors directory-level authentication through the control panel's password protection feature. It doesn't apply to application-level logins like WordPress or custom authentication systems.
How do I disable leech protection if I no longer need it?
To disable leech protection, navigate to the protected directory through the Leech Protection interface and click the disable or remove option. This turns off monitoring without affecting the directory's password protection. Users can then log in as many times as needed without triggering restrictions.
Our support team is available 24/7 to help you configure leech protection or troubleshoot any security concerns. Visit our contact page or email support@obhost.org for assistance with protecting your directories and managing user access.
