I password protected a site by putting a password on the public_html directory. Now three weeks later, the client sent me an email saying it was open. I checked and there was no longer a check mark indicating the directory was password protected. I didn't unprotect it.
cPanel Version 11.38.2 (build 2)
cPanel Version 11.38.2 (build 2)