.htaccess guide for cPanel hosting
The .htaccess file controls URL redirects, access rules, PHP settings, password protection, and custom error pages.
UnderHost NOC
Network Operations
On this page
The .htaccess file is a per-directory configuration file for Apache web server. It lets you control URL rewriting, redirects, access rules, caching headers, and PHP settings without touching the server-level config. WordPress, Joomla, and most CMSes rely on it.
A single mistake in .htaccess causes a 500 Internal Server Error for all visitors. Always keep a backup before editing. If your site breaks, rename or delete the .htaccess file to restore access, then fix the error.
File location and editing
The main .htaccess file is in your public_html folder. It is a hidden file-in cPanel File Manager, click Settings (top-right) and check Show Hidden Files. You can edit it directly in File Manager by right-clicking → Edit, or download it, edit locally, and re-upload.
Redirects
Redirect HTTP to HTTPS (if SSL is active):
RewriteEngine On
RewriteCond %{HTTPS} off
RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [L,R=301]Redirect www to non-www:
RewriteEngine On
RewriteCond %{HTTP_HOST} ^www\.(.+)$ [NC]
RewriteRule ^ https://%1%{REQUEST_URI} [L,R=301]Redirect a single old URL to a new one:
Redirect 301 /old-page.html https://yourdomain.com/new-page/PHP settings
Increase PHP limits without touching php.ini:
php_value upload_max_filesize 64M
php_value post_max_size 64M
php_value max_execution_time 120
php_value memory_limit 256MOn cPanel hosting, it is often easier and more reliable to set PHP values through cPanel → MultiPHP INI Editor than via .htaccess. Both methods work, but the cPanel tool validates input and avoids syntax errors.
Password protect a directory
Create a file called .htpasswd in a private location (outside public_html), generate a hashed password, and reference it:
AuthType Basic
AuthName "Restricted Area"
AuthUserFile /home/cpusername/.htpasswd
Require valid-userGenerate the .htpasswd entry at htpasswd.net or use cPanel → Directory Privacy for a GUI approach.
Block access to files or directories
Block access to sensitive files like wp-config.php:
<Files wp-config.php>
Order allow,deny
Deny from all
</Files>Block a specific IP address:
Deny from 192.168.1.100Custom error pages
ErrorDocument 404 /404.html
ErrorDocument 500 /500.html
ErrorDocument 403 /403.htmlCreate the corresponding HTML files in public_html to match these paths.
Troubleshoot .htaccess errors
- 500 error after saving-syntax error in .htaccess. Rename the file to
.htaccess.bakto disable it, then edit and rename back. - Redirect loop-usually caused by conflicting HTTPS redirect rules, often when Cloudflare is also forcing HTTPS. Remove duplicate redirect rules.
- Rules ignored-ensure
AllowOverride Allis set server-side (it is on shared hosting). On VPS, you need to enable it in the Apache virtual host config.
Related: Password protect directory | Upload website | Shared hosting overview | Configuring email in Outlook, Thunderbird, and Apple Mail
Need shared hosting?
Choose an UnderHost shared hosting plan with cPanel, email, SSL, DNS tools, and 24/7 support.
