What is the .htaccess file and how do I edit it?

.htaccess is Apache web server's per-directory configuration file. It affects the directory it's in and all subfolders; changes take effect immediately without needing to restart the server. From URL redirection to enforcing HTTPS, from file blocking to cache rules, you can manage many settings from here. Because its name starts with a dot, it is a hidden file and may not be visible in File Manager by default.

1. Editing via File Manager

1. Log in to cPanel.
2. In the Files section, click File Manager.
3. On first open, click Settings at the top right and enable Show Hidden Files (dotfiles). Otherwise .htaccess won't appear in the list.
4. Enter the public_html directory.
5. Select .htaccess and click Edit or Code Editor at the top (Code Editor is recommended for syntax highlighting).
6. Make your changes and click Save Changes. Changes are immediately active; you can refresh your browser to test.

2. Common .htaccess Examples

Automatic HTTP-to-HTTPS redirect:

RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^(.*)$ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

Redirect to the non-www version (e.g. www.yoursite.com → yoursite.com):

RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^(.*)$ https://%1/$1 [L,R=301]

Redirect to the www version (opposite):

RewriteEngine On
RewriteCond %{HTTP_HOST} !^www\. [NC]
RewriteRule ^(.*)$ https://www.%{HTTP_HOST}%{REQUEST_URI} [L,R=301]

301 redirect for a single page:

Redirect 301 /old-page.html /new-page.html

Custom 404 page:

ErrorDocument 404 /404.html

3. Security Rules

Disable directory listing (prevents file listing in folders without an index file):

Options -Indexes

Block access to sensitive files (.env, config.php, wp-config.php, etc.):

<FilesMatch "^(\.env|\.git|wp-config\.php|config\.php)$">
    Require all denied
</FilesMatch>

Block a specific IP:

<RequireAll>
    Require all granted
    Require not ip 192.0.2.10
</RequireAll>

4. WordPress and cPanel Auto-Generated Blocks

If your site uses WordPress, you'll find a block like this in your .htaccess:

# BEGIN WordPress
<IfModule mod_rewrite.c>
RewriteEngine On
RewriteBase /
...
</IfModule>
# END WordPress

Don't delete or manually edit this block; it is automatically regenerated when you save WordPress permalink settings. Similarly, when you select a PHP version in cPanel, a block starting with # php -- BEGIN cPanel-generated handler is added; that's also managed automatically.

Write your own rules outside these auto-generated blocks (above or below). Otherwise your changes will be erased when WordPress or cPanel updates the block.

5. If You Get a 500 Internal Server Error

If your site shows a white screen or 500 error after editing, there's almost always a syntax error in .htaccess. Solution:

1. Open File Manager, replace .htaccess with your backup (.htaccess.bak).
2. If you don't have a backup, temporarily rename the file to htaccess-old.txt. The site will then open with the default Apache configuration.
3. Find and fix the broken line, then rename the file back to .htaccess.

If you're stuck on an .htaccess rule, you can open a support ticket describing the behavior you want; our team will suggest the appropriate rule and help you apply it.