How to Protect Your .htaccess File

Tip: if you cannot see the .htaccess file in cPanel File Manager, enable Show Hidden Files (dotfiles) in File Manager settings.

To prevent visitors from requesting your .htaccess file directly, add this rule to the file in your site’s document root:

# Protect .htaccess
<Files ".htaccess">
    Require all denied
</Files>

On older Apache configurations, the equivalent rule is:

<Files ".htaccess">
    Order allow,deny
    Deny from all
</Files>