How-to · Advanced · 30 minutes
How to Harden a Site With .htaccess
A handful of careful lines that put protection at the server, before your site runs — a practical, jargon-free walkthrough with the classic mistake flagged before you make it.
Straight answer first
In a line: a handful of careful lines that put protection at the server, before your site runs — a advanced-level task that takes 30 minutes.
Below you get the exact steps, the classic snag, and a tip from the support desk. Where our platform handles a step for you, the guide says so rather than making you do the robot's work.
Written by the Hosting Seller staff · Checked 1 August 2026
Advanced
Difficulty level
30 minutes
Time to allow
5
Stages
24/7
Help at any hour
This guide assumes no expertise at all — just a hosting account, a browser and 30 minutes of attention. Every instruction works on our platform exactly as written, and carries over to any standard cPanel host.
One promise before you start: nothing in this guide is irreversible. Where a step could bite, we say so and give you the undo.
The shape of the work
From start to finish, you will copy the file before you touch it, shut off the obvious targets, add the browser-side headers, trim the automated noise and add one block, then reload.
No stage needs code or a terminal unless the guide says so outright, and where it does, the exact commands are printed. The full step-by-step sits below; the sections around it give the context that makes it stick.
The classic snag
Pasting a fifty-line list of 'ultimate security rules' from a forum in one go. One deprecated directive whites out the site, and the offending line is now hiding in a haystack you built yourself.
Forewarned really is forearmed here. This one mistake accounts for most of the frustration the subject produces, and it is entirely avoidable once somebody names it.
One habit that makes this easy for good
Blocking PHP execution in the uploads folder is the single best line here. Uploaded-shell attacks depend on running what they smuggled in, and this rule turns their payload into an inert text file.
It costs a minute now and pays that back every time the job comes round again — which, like most hosting jobs, it certainly will.
The parts we have already done for you
Several steps in this guide exist only because hosting historically made you do them. On our plans SSL issues itself, backups run daily without being asked, and one-click installers replace the manual setup entirely. What is left is the part that is genuinely yours.
And when a step misbehaves anyway, support answers at any hour with the actual fix, not a knowledge-base link and a shrug. Half our best guides began life as a pattern in the ticket queue.
A good platform makes every guide shorter
Tutorials age badly when they are written against imaginary hosting. These are written against ours: the same panel, the same installer and the same defaults you will meet.
Order an annual plan and the first year of your domain registration is on the house.
- Step by step, tested exactly as printed
- The snag flagged before you reach it
- The dull steps are already automated
- People on hand at any hour if you stall
Why Hosting Seller
On every plan, as standard
The snag, named early
The classic mistake for this exact job is flagged before step one, so 30 minutes stays 30 minutes.
Works exactly as written
Every step tested on the platform we run — no 'your host may differ' hand-waving anywhere.
Automation where it belongs
SSL, backups and installs run themselves here, so the guide covers only what is genuinely yours to do.
The undo is always named
Where a step could bite, the guide says so and tells you how to put it back again.
Help on the counter
Stuck on step three at midnight? Support answers at any hour, mid-guide included.
No jargon toll
Terms are explained where they appear or linked to the glossary — nothing assumes you already know.
First Steps
From choosing to live
- 1
Copy the file before you touch it
One typo in .htaccess takes the whole site to a 500 error. With a copy saved somewhere safe, recovery is a paste rather than a panic.
- 2
Shut off the obvious targets
Deny direct access to wp-config.php and stop PHP running inside the uploads directory. Two short stanzas that close the most-abused paths on the internet.
- 3
Add the browser-side headers
X-Frame-Options, X-Content-Type-Options and Referrer-Policy set guardrails in the visitor's browser. A few Header lines with a great deal of effect for their size.
- 4
Trim the automated noise
Restricting xmlrpc.php and odd request methods cuts out a good share of the automated abuse that otherwise fills your access logs every night.
- 5
Add one block, then reload
One stanza, reload the site, carry on. Because .htaccess failures are total rather than partial, testing as you go keeps the culprit obvious.
In the Box
Packed with every plan
- NVMe SSD storage on every shelf, not just the top one
- A 99.9% uptime commitment, watched by monitoring day and night
- One-click installs for WordPress and 400+ other applications
- Spam and virus filtering fitted to every mailbox
- A 30-day money-back guarantee on every hosting plan
- A backup taken daily, with restores you run yourself
- Site migration done for you by our staff, at no charge
- The renewal price printed on the tag matches the order price
- LiteSpeed caching running at the server, not bolted on by plugin
- Real people on the counter, every hour of every day
Across the Counter
The questions we get asked most
Do these rules mean I can drop the security plugin?
They work at a different level. The server applies them before PHP even wakes up, which is cheaper and earlier than any plugin check. The strongest arrangement stacks server rules, platform protection of the Imunify kind, and light hardening inside the application.
I edited .htaccess and the site went down — how do I get it back?
File Manager, restore your copy, or delete the lines you added. The 500 clears the moment you save. If you kept no copy, re-saving the permalinks page in WordPress writes a clean default file for you.
How quickly can I be up and running?
Minutes, not days. The account opens the moment the order clears, the domain — free for year one on annual plans — attaches straight away, and the one-click installer puts WordPress or any of 400+ applications on the page before you leave your chair. Already have a site elsewhere? Hand it over and we move it free, usually inside a day.
Where do the servers actually sit?
Our hosting runs from European datacentres with London at the centre, behind server-level caching that keeps cached pages quick for visitors anywhere. For most sites the build of the platform — NVMe disks, LiteSpeed, sensible numbers of accounts per machine — decides the speed far more than the postcode does.
Does the price climb when the term is up?
No. What you pay to order is what you pay to renew, year after year. We do not run teaser rates, so there is no year-two ambush waiting in the calendar, and your bookkeeping can treat the hosting line as a fixed number.
Does hosting come with mailboxes?
It does — mailboxes on your own domain ship with every hosting plan, with webmail, IMAP, POP and SMTP access and spam filtering fitted as standard. There is also standalone email hosting for domains whose website lives somewhere else entirely.
How do I read the mail when I am away from the desk?
Webmail opens in any browser, and every mailbox also speaks IMAP, POP and SMTP — so the mail app on your phone, the client on your desktop and webmail all show the same messages in the same order.
Read next
How to Start a Blog on Your Domain
Publishing on ground you own, arranged so the work adds up — beginner level, about an afternoon.
How to Set Up a Cron Job
Put a script on a schedule and trust it to run without you watching — intermediate level, about 15 minutes.
Charity Hosting
Reduced prices for charities and nonprofits, essentials still included.
Website Builder
Drag, drop and publish on quick hosting, with no code to write.
Packing up and moving host? Take our checklist.
A plain running order for a move nobody notices: what to copy first, how to carry email across without dropping a single message, when to point DNS, and the two slips behind nearly every hour of downtime we get called about.
Give your website a proper home.
Quick NVMe hosting, SSL and the move in included, and real people on the counter at any hour — on a price that doesn't shift.
See the plans