Config review · Advanced · 30 min
.htaccess Hardening, One Directive at a Time
A config file the server re-reads on every request deserves the same review as code: keep it short, add one stanza at a time, and verify each with a header check.
The short answer
Treat .htaccess as code that runs on every single request: add one stanza at a time, verify it with curl, and keep the file short — because the server re-reads it per request and per directory in the path, so length is not free.
The directives that genuinely earn their keep are few. Deny direct access to wp-config.php, forbid PHP execution inside uploads, limit xmlrpc.php, and emit three cheap security headers. Everything beyond that is usually better handled by the layers built for it: Imunify at server level and DDoS filtering at the network edge.
By the HostingFast team · Reviewed 12 August 2026
Advanced
Assumed level
5
Stages to done
Free
Support cost
Proven
Verified on production
Thirty minutes, and the first five of them are spent making a copy of the file. A single stray character in .htaccess returns 500 for the entire document root, which is why the recovery route comes before the edits.
Everything here works on our stack: LiteSpeed reads .htaccess with Apache-compatible semantics, so the directives below behave as documented rather than as approximations.
What you are paying, per request
Apache-compatible servers check for .htaccess in the requested directory and in every parent up to the document root, on every request, and parse what they find. That is cheap for a short file near the root and progressively less cheap for a long file, or several files scattered down a deep tree. It is also why a rule in the wrong directory silently applies to more than you intended.
Practical consequence: keep one short file at the root rather than five long ones, put rules as close to the root as their scope allows, and delete anything you cannot justify. A hundred lines of accumulated snippets from four different tutorials is a maintenance liability as well as a small tax.
The directives that actually close something
Deny direct requests to wp-config.php, so a misconfigured handler cannot serve your database credentials as plain text. Forbid PHP execution inside wp-content/uploads with a Files or FilesMatch block, which turns a successful file upload from a remote code execution into an inert file sitting on disk. Those two stanzas cover the most-attacked paths on the web and cost you nothing.
Then xmlrpc.php: unless you use the XML-RPC API deliberately, denying it removes a well-worn brute-force and amplification target and a fair slice of the noise in your access log. Restricting unusual request methods trims more of the same.
Security headers, and proving they arrived
Three Header lines punch well above their weight: X-Frame-Options to stop your pages being framed, X-Content-Type-Options: nosniff to stop content-type guessing, and a Referrer-Policy so your URLs stop leaking to third parties. Add Strict-Transport-Security once you are certain every hostname you serve is HTTPS-only, because it is deliberately hard to undo.
A Content-Security-Policy is the powerful one and the one that breaks sites, because it requires an accurate inventory of every script, style and font origin you actually load. Start in report-only mode, read the reports, then enforce. And verify every header the same way: curl -sI https://example.com | grep -i x-frame-options. A header you have not seen in a response is a header you did not send.
The 500, and the way back from it
An invalid directive does not fail gracefully. It returns 500 for everything under that directory, including your admin login, which is why the copy matters: cp .htaccess .htaccess.bak over SSH takes a second and turns recovery into one command. The error log names the offending line, and cPanel's Errors page shows it without a shell.
This all-or-nothing behaviour is also what makes incremental editing worthwhile. One stanza, reload, check the status line: curl -sI https://example.com | head -1. When something breaks you already know which addition did it, because it was the only one.
How .htaccess behaves on our servers
LiteSpeed Enterprise reads .htaccess with Apache-compatible semantics on every account here, so the directives above behave as documented and the error log names the failing line.
Full SSH access with Git and Composer is on every shared tier, which is what makes copy-before-edit and one-command recovery practical.
- Per-request parsing cost explained, not ignored
- Every rule paired with the curl that verifies it
- Recovery from a 500 sorted before the first edit
- Support at any hour if the file locks you out
Why HostingFast
Standard on every plan
Cost model included
Why the file is re-read per request and per parent directory, and what that means for how long yours should be.
Short list, hard justification
Four directives that genuinely close something, rather than a hundred lines copied from four tutorials.
Headers you can see
Each header paired with the curl command that proves it arrived, because unverified configuration is just optimism.
CSP handled honestly
Report-only first, inventory your origins, then enforce — the order that avoids breaking your own site.
Recovery before risk
The backup copy and the one-line status check come before any edit, so a 500 is a paste rather than a panic.
Boundaries named
What belongs in .htaccess and what belongs to Imunify and the network edge, so you stop asking a config file to be a firewall.
Quick Start
From order to online
- 1
Copy the file and rehearse the recovery
cp .htaccess .htaccess.bak over SSH, or download it first. Know the exact command that puts it back before you make the first change, because you will be doing it while the site returns 500.
- 2
Close the two most-attacked paths
Deny direct access to wp-config.php, and forbid PHP execution under wp-content/uploads. Two short stanzas, and between them they neutralise the most common outcome of a successful file upload.
- 3
Emit the three cheap headers, then check them
X-Frame-Options, X-Content-Type-Options: nosniff, Referrer-Policy. Then curl -sI https://example.com and read them back. Add HSTS only when every hostname is HTTPS-only, and keep CSP in report-only until your origin inventory is complete.
- 4
Cut the automated noise
Deny xmlrpc.php unless you actually use the API, and limit unusual request methods. Re-read the access log a week later: the volume drop is the measurement that tells you it worked.
- 5
Add one stanza, reload, verify, repeat
curl -sI https://example.com | head -1 after each addition. Because .htaccess failures are all-or-nothing, incremental editing means the guilty line is always the last one you typed.
Built In
Loaded onto every plan
- LiteSpeed Enterprise reading .htaccess with Apache-compatible semantics
- Full SSH access with Git and Composer on every shared plan
- cPanel error log pages, so a 500 names its own failing line
- Imunify protection at server level for the rules .htaccess should not carry
- DDoS filtering absorbed out at the network edge
- Free SSL on every plan, renewed automatically before HSTS can bite
- Daily backups with self-service restores from the panel
- Per-site PHP version switching from the control panel
- Money-back cover: 30 days on hosting plans, 7 on reseller
- Human support on duty every hour of every day
Frequently Asked
What people ask us most often
Does a long .htaccess measurably slow a site down?
Measurably, yes; dramatically, no. The server checks for and parses the file on every request, in the requested directory and every parent up to the document root, so a hundred-line file scattered across a deep tree costs more than a short one at the root. The effect is small next to an uncached page, but it is real, and it is a good reason to delete accumulated snippets you can no longer justify.
My edit returned a 500 — how do I read the error and recover?
Recovery first: restore .htaccess.bak, or rename the file so the server ignores it, and the site returns immediately. Then find the cause in the error log, either from cPanel's Errors page or by tailing the log over SSH — an invalid directive is reported with its line number. This is why the copy is step one: the fix is a single command rather than an evening of guessing.
Does LiteSpeed honour Apache .htaccess directives?
Yes. LiteSpeed Enterprise reads .htaccess with Apache-compatible semantics, which is a large part of why cPanel hosting on LiteSpeed is a drop-in for an Apache stack. Rewrite rules, Files blocks, Header directives and ErrorDocument all behave as documented, so tutorials written for Apache apply here without translation.
Should these rules live in .htaccess or in the application's config?
Put a rule at the outermost layer that can enforce it. Denying access to a file or refusing to execute PHP in a directory belongs in .htaccess, because it works even if the application is compromised. Application-level logic — user roles, capability checks, form validation — belongs in the application, where it has the context to make the decision. Rate limiting and attack-pattern matching belong to neither: those are jobs for Imunify and the network edge.
Keep reading
How to Enable WHOIS Privacy
Keep your registrant details out of public WHOIS without losing control of the name.
How to Create a Subdomain
Stand up a subdomain with its own document root and its own certificate.
.htaccess (Glossary)
What the file is, where the server looks for it, and the cost of every line.
Agency Hosting
Multiple client sites, staging copies and shell access on one account.
cPanel Reseller Hosting
WHM on top of cPanel, so each account you create is walled off from the next.
Changing hosts? Run through our checklist first.
A straightforward sequence for a switch your visitors never feel: which files move first, how to shift email across without losing a single message, the right moment to repoint DNS, and the two mistakes behind almost all the downtime we get asked to rescue.
A server that reads your config as written.
LiteSpeed with Apache-compatible .htaccess, SSH on every plan, Imunify at server level, DDoS filtering at the edge, and support at any hour.
View Agency Hosting plans