.htaccess File Reference List: Rules, Fixes, and Uses

The .htaccess file controls how Apache serves the directory it lives in, along with every folder beneath it. This reference groups our .htaccess guides by what you are actually trying to do: redirect traffic, restrict access, speed up delivery, change how files are served, or repair a file that broke your site.

What the .htaccess File Does on Your Server

A .htaccess file is a distributed configuration file. You place it in a directory, and the directives inside apply to that directory and all of its subdirectories, which is why a single rule in public_html can affect an entire site (Apache HTTP Server documentation).

New to the file itself? Start with What is the .htaccess file and what do I use it for? before working through the rules below.

Find the Right Guide Fast

Your Goal	Section to Read
Send visitors to HTTPS or a new URL	Redirects and URL Rewriting
Block an IP, country, or bad actor	Restricting Access
Speed up delivery or stop a page from caching	Caching and Delivery Speed
Change the default page or hide extensions	File Handling
Replace the default 404 screen	Custom Error Pages
Fix a 500 or 403 error you just caused	Fixing a Broken File

Before You Edit .htaccess, Do These Three Things

Small syntax mistakes in this file take down the whole site, not just one page. Three habits prevent most of the support tickets we see:

1. Copy the existing file before you change it. A rollback takes seconds when you have the original.
2. Turn on hidden files in your editor. The leading dot hides it by default, so use How to show hidden files (.htaccess) in cPanel’s File Manager if the file seems to be missing.
3. Test in a browser with cache disabled after every change. Cached redirects, especially 301s, are difficult to undo once a browser stores them.

How Do You Redirect URLs and Force HTTPS With .htaccess?

Redirect rules are the most common reason people open this file. They also carry the most SEO weight, so the difference between a temporary and permanent redirect matters.

• How to Force HTTPS With the .htaccess File: sends all HTTP requests to the secure version of your site after your SSL certificate is active.
• How to Set Up a 301 Permanent Redirect via .htaccess and cPanel: passes ranking signals to the new URL when a page moves for good.
• How to Force www and non-www on Your Domain With .htaccess: picks one canonical hostname so search engines stop treating both versions as separate sites.
• Redirecting Visitors to an Under Construction Page: holds traffic on a placeholder while you rebuild, without taking the domain offline.
• Do You Support Mod_Rewrite?: confirms the module behind every rewrite rule is available on your account.

How Do You Restrict Access With .htaccess?

Access rules work at the server level, which means a blocked request never reaches WordPress, PHP, or your database. That makes .htaccess a useful first layer against brute force login attempts and scrapers.

Blocking Visitors by IP, Country, or Behavior

• Restrict Access With .htaccess and the IP Deny Manager: blocks a single address or range through cPanel instead of hand-editing rules.
• Block Unwanted Users From Your Site Using .htaccess: covers deny rules for repeat offenders showing up in your access logs.
• How to Block a Country’s IP Ranges in .htaccess: useful when you sell in one region and see junk traffic from another.
• How to Lock Down the WordPress Admin Login With .htaccess Rules: limits wp-login.php to trusted addresses, which cuts CPU load caused by login floods.

Protecting Individual Files and Directories

• Preventing the “Index Of” Page in .htaccess: stops Apache from listing every file in a directory that has no index page, which is a common source of accidental exposure.
• How to Prevent Access to a Specific File in .htaccess: hides configuration files, backups, or anything not meant to be public.
• How to Prevent Access to Multiple File Types in .htaccess: applies one rule to a group of extensions such as .log, .sql, or .ini.
• How to Password Protect a Single File With .htaccess: adds an HTTP authentication prompt without touching your application code.
• Restrict Public Access to Your php.ini: keeps your PHP configuration values out of public view.
• Hotlink Protect Files in .htaccess and cPanel: stops other sites from serving your images off your bandwidth.
• Set Content Security Policy (CSP) Headers With .htaccess: tells browsers which sources are allowed to load scripts, styles, and media on your pages, which limits cross-site scripting and injected content.

Which .htaccess Rules Control Caching and Delivery Speed?

Two directives do most of the performance work. Compression shrinks what leaves the server, and cache headers stop returning visitors from downloading assets they already have. The reverse matters too: some pages should never be cached at all.

Speeding Up Delivery

• An Introduction to gzip and mod_deflate: compresses HTML, CSS, and JavaScript before delivery, often cutting text file size by more than half.
• How to Add Apache Module mod_expires in Your .htaccess: sets expiration headers on images, fonts, and stylesheets so browsers cache them between visits.

Turning Caching Off Where It Causes Problems

• How to Set Up Non-cached Pages With .htaccess: excludes specific pages from caching, which matters for carts, checkout, dashboards, and anything showing user-specific content.
• How to Disable Caching in the .htaccess File: turns caching off across a directory, useful during active development or while troubleshooting content that will not refresh.

Both compression changes show up quickly in tools like PageSpeed Insights or GTmetrix, which makes them easy to verify.

How Do You Control the Way Files Are Served?

These rules change what the server does with a request before your application ever sees it.

• How to Change Your Default Index Page in .htaccess: points a directory at home.html or any file other than index.html.
• Removing File Extensions From Displaying in the Browser via .htaccess: serves /about instead of /about.php for cleaner URLs.
• Forcing a File to Download in a Browser via .htaccess: prompts a save dialog for PDFs and media instead of opening them inline.
• Using Server Side Includes With HTML Files: enables SSI so shared headers and footers render inside .html files.
• How Do I Execute PHP Code in an HTML Page?: tells the server to parse .html files through the PHP handler.
• How to Change Your Default Timezone in .htaccess: corrects timestamps on forms, logs, and posts without editing PHP settings globally.

How Do You Set a Custom Error Page?

A default Apache error screen tells visitors nothing and gives them nowhere to go. How to Set a Custom 404 Page Using .htaccess walks through pointing missing URLs at a branded page with search and navigation, which recovers traffic that would otherwise bounce.

How Do You Fix a Broken .htaccess File?

If your site broke immediately after saving this file, the file is almost certainly the cause. Restore your backup first, then work out which directive failed.

• 500 Internal Server Error: the usual result of a typo, an unsupported directive, or a module that is not loaded.
• 403 Forbidden Error: points to a deny rule or permission conflict blocking legitimate requests.
• Why Is “order allow deny from all” in My .htaccess File?: explains legacy access syntax you may inherit from older code or a previous host.
• Can’t Update PHP Settings in .htaccess: what to do when php_value lines are ignored or throw errors.
• How to Reset the WordPress .htaccess File: restores the default WordPress rewrite block when permalinks stop resolving.

What Should You Do if Your .htaccess File Was Hacked?

Malicious redirects and injected rewrite rules are a common symptom of a compromised site, and attackers favor this file because visitors get redirected before any application code runs. Cleaning Up a .htaccess Hack covers removing the injected rules. Treat the cleanup as one step: if the file was modified, something else on the account was likely modified too, so scan for the entry point before you consider it resolved.

When Should These Rules Move Out of .htaccess?

Apache reads .htaccess on every request and checks parent directories along the way, so heavy rule sets add measurable overhead under load. Apache’s own documentation recommends placing directives in the main server configuration whenever you have access to it (Apache HTTP Server documentation). That access requires root, which comes with VPS Hosting and Dedicated Servers, not shared plans.

For most sites the difference is small. It becomes worth acting on when you are running dozens of rewrite rules, serving high concurrency traffic, or seeing time to first byte climb without an obvious application cause.

Where to Get Help With .htaccess Rules

Editing this file is well within reach for most site owners, and the guides above cover the common cases. If a rule is not behaving as expected, or your site is down and you cannot identify which directive caused it, our support team is available 24/7 and can review the file with you. Contact us and we will take a look.