Walkthrough · Advanced · 30 minutes
How to Harden a Site With .htaccess
A few deliberate lines that put defences at the server, in front of your application — a hands-on walkthrough in plain words that names the classic mistake before you reach it.
The short answer
One line covers it: a few deliberate lines that put defences at the server, in front of your application — a advanced-level job of roughly 30 minutes.
Below are the precise steps, the classic stumble, and one tip from the support desk. Wherever the platform already does a step for you, the guide says so rather than handing you a machine's chores.
By the Hosting & Domains team · Reviewed 18 August 2026
Advanced
Experience required
5
Stages, start to finish
Free
Support included
Proven
On the platform itself
No prior knowledge assumed — a hosting account, a browser and 30 minutes of attention is the whole entry requirement. Every instruction runs on our platform exactly as printed, and carries over to any standard cPanel host.
A promise before step one: nothing here is a one-way door. Any step with teeth is flagged, and the way back is printed beside it.
How the work divides up
Over the whole job, you will copy the file before you edit it, close the well-known targets, send security headers to browsers, cut the robotic noise down and add one stanza, then reload.
No part of this needs code or a terminal unless the guide says so plainly — and where it does, the exact commands are printed. The step-by-step is below, with the surrounding sections supplying the context that makes it hold.
The well-worn snag
Pasting a fifty-line 'ultimate security rules' block from a forum in one go. A single deprecated directive blanks the site, and the broken line is now buried in a haystack of your own making.
Forewarned is genuinely forearmed here. This one mistake accounts for most of the frustration the topic ever causes — and it disappears entirely once somebody points it out.
The habit that keeps this easy for good
Of everything here, the line stopping PHP from running under uploads does the most work. Upload-shell attacks depend on running what they smuggled in, and this rule reduces the payload to inert text.
A minute spent now repays itself every time this job comes round again — and like almost every hosting job, come round it will.
The steps already done before you arrive
Some steps in this guide exist only because hosting traditionally forced them on you. Here the SSL issues itself, the copy is taken daily without being asked, and one-click installers remove the manual setup. What is left is the part that was always genuinely yours.
Should a step still misfire, support answers at any hour with an actual fix rather than a knowledge-base link and a shrug. Half the guides on this site began as repeat patterns in our ticket queue.
Why this job is shorter on our plans
Every walkthrough in this library is run on the platform we actually operate — cPanel, LiteSpeed, NVMe, one-click installs — so the instructions match your screen rather than gesturing at it from a distance.
NVMe storage and LiteSpeed caching sit under every tier, the smallest plan included — that is the floor here, not an upgrade.
- Every step checked exactly as published
- The snag named before it arrives
- The dull steps taken out of your way
- People reachable at any hour you stall
Why Hosting & Domains
Standard on every plan
The snag, flagged up front
The classic error for this particular task is named before step one, which is how 30 minutes stays 30 minutes.
Works exactly as printed
Every step is proven on the platform we run — none of the 'your host may vary' hedging.
The dull parts automated
SSL, backups and installs look after themselves here, leaving the guide to cover only what is genuinely yours.
Every undo written out
Any step that could bite is marked, together with the exact way to wind it back.
Help that keeps your hours, not ours
Stuck on step three at midnight? Support answers at any hour, mid-walkthrough included.
Jargon never charges you
Every term is defined on the spot or linked to the jargon buster — nothing assumes prior knowledge.
Quick Start
Order placed to site online
- 1
Copy the file before you edit it
One typo in .htaccess drops the whole site into a 500 error. With a spare copy stored safely, recovery is a single paste rather than a panic.
- 2
Close the well-known targets
Refuse direct requests for wp-config.php, and stop PHP running anywhere under uploads. Two short stanzas that seal the most-attacked paths on the web.
- 3
Send security headers to browsers
X-Frame-Options, X-Content-Type-Options and Referrer-Policy put guardrails inside the visitor's browser. Three or four Header lines that earn far more than they cost.
- 4
Cut the robotic noise down
Limiting xmlrpc.php and unusual request methods removes a solid share of the automated abuse that otherwise fills your access logs every night.
- 5
Add one stanza, then reload
Add a block, reload the site, carry on. Because .htaccess failures are all-or-nothing, testing a piece at a time keeps the guilty line obvious.
Built In
Fitted to every plan
- People on the support desk every hour of every day
- Softaculous included for one-click application installs
- Spam and virus screening on every mailbox by default
- NVMe SSD storage on every tier, not only the dear ones
- 99.9% uptime as the target, watched around the clock
- WordPress and 400+ further applications installed in one click
- Webmail in the browser plus IMAP, POP and SMTP for any client
- WordPress Toolkit, with the updates seen to for you
- LiteSpeed caching in the server itself rather than bolted on by plugin
- Your existing site brought across by our engineers, at no charge
Frequently Asked
The questions that come up most
With these rules in place, do I still need a security plugin?
They work at different depths. The server enforces these before PHP even stirs, which is cheaper and earlier than any plugin manages. The strongest arrangement layers server rules, Imunify-style platform protection, and modest hardening inside the application.
My .htaccess edit took the site offline — how do I recover?
Open File Manager and restore your saved copy, or delete the lines you added. The 500 disappears the moment you save. With no copy kept, re-saving WordPress permalinks rebuilds a clean default file.
How quickly can a site be live?
Quickly — minutes rather than days. The account opens the moment payment clears, the domain (free for the first year on annual plans) attaches straight away, and the one-click installer has WordPress or any of 240+ applications running before your coffee cools. Site already somewhere else? Send the details and we move it free, normally within a day.
Where does the hardware physically sit?
The platform runs from a London datacentre with redundant power, cooling and several upstream carriers, with server-level caching in front that keeps cached pages quick for visitors anywhere. For most sites how the platform is built — NVMe disks, LiteSpeed, restrained account density per machine — counts for far more than where it sits.
Keep reading
How to Enable WHOIS Privacy
Keep your personal address and phone number off the public registration record — beginner level, about 2 minutes.
How to Create a Subdomain
Put blog.yourdomain or app.yourdomain live in less time than it takes to make coffee — beginner level, about 5 minutes.
.htaccess (Glossary)
The plain-English definition this page rests on, with a worked example.
Agency Hosting
Client accounts, staging and care-plan infrastructure arranged for agencies.
cPanel Reseller Hosting
The industry-standard panel sized for resellers, WHM included.
Changing hosts? Run through our checklist first.
A plain order of work for a move nobody visiting will notice: which files go over first, how to carry the mail across without losing a message, when exactly to repoint DNS, and the two mistakes behind nearly every outage we are asked to rescue.
Your site has earned better hosting.
From a first website to a rack of machines, moving up is a change to the account rather than a migration.
View Agency Hosting plans