By default, Plesk protects the website statistics page with authentication. This prevents unauthorized users from viewing traffic data, error logs, and other usage details. In some cases, you may want to remove this protection so the statistics page can be accessed without a username and password.
This option is available on servers where you manage site-level settings, which is common on environments using Plesk hosting.
Before You Make This Change
The statistics page can expose sensitive information such as visitor counts, requested URLs, and error details. Removing authentication means anyone who knows the URL can view this data.
Only disable protection if:
- The statistics page is used internally
- Access is already restricted by other means
- The data does not contain sensitive information
On public-facing projects hosted on cloud servers, keeping statistics protected is generally recommended.
Removing Password Protection
Step 1: Open Hosting Settings
Log in to the Plesk control panel.
From the left sidebar, open Websites & Domains, locate the domain you want to change, and click Hosting Settings.
[Screenshot: Websites & Domains page with Hosting Settings highlighted]
Step 2: Locate statistics protection settings
Scroll down to the Web scripting and statistics section of the Hosting Settings page.
[Screenshot: Web scripting and statistics section]
Step 3: Disable password protection
Clear the option labeled Protect access to your web statistics with your FTP username and password.
[Screenshot: Statistics protection checkbox cleared]
Click OK to save the changes.
Once saved, the statistics page can be viewed without authentication.
After the Change
Open the statistics page in a browser to confirm that it loads without requesting credentials. If the page is publicly accessible, verify that no sensitive data is exposed.
For environments where security policies are strict, such as those running on dedicated server infrastructure, consider keeping statistics protected or restricting access at the web server or firewall level.